2

I develop and support a program which uses (S)FTP to download files to corporate servers. Corporate clients often require my program to go through a proxy rather than connecting directly. Unfortunately, (S)FTP proxies don't seem to be standardized, particularly regarding authentication.

I'd like to find some standard way to interact with an (S)FTP proxy, without knowing the vendor in advance.

If that's not possible, I'd like to pull together a list of the different (S)FTP proxy types, their pros and cons (if I have a choice which to use), how to use them, examples of vendors implementing them, links to more information, etc.

1 Answer 1

1

Here's what I've found so far:

  • Checkpoint login-syntax
    • Works for FTP
    • Works by passing extra information to the proxy through the USER and PASS commands.
    • Since no special commands are required, every FTP-aware program should be able to use this method, even if it has no built-in notion of proxies. You just change the user/pass that it uses.
    • USER: ftp_username@proxy_username@ftp_host
    • PASS: ftp_password@proxy_password
    • Used by: Bluecoat ProxySG, probably others.
    • More details: https://kb.bluecoat.com/index?page=content&id=KB2898
  • Raptor login-syntax
    • Works for FTP
    • Similar to Checkpoint except the proxy password is passed using ACCT.
    • Requires the program to understand ACCT, but separates the passwords which may be preferable. Supports @ character in the password unlike Checkpoint.
    • USER: ftp_username@ftp_host proxy_username
    • PASS: ftp_password
    • ACCT: proxy_password
    • Used by: Bluecoat ProxySG, probably others.
    • More details: Same link as above (SuperUser limits me to 2 links)
  • SOCKS
    • Works for any protocol
    • SOCKS is a standardized proxying protocol.
    • SOCKS can be used not only for FTP but for completely different protocols as well.
    • If a program understands and can use SOCKS, this is probably the most flexible solution. However, implementation may be more complicated.
    • More details: SOCKS on Wikipedia
  • HTTP CONNECT
    • Works for FTP
    • Start off with an HTTP connection to a proxy server. Once the connection through the proxy is established, TCP is still used but the client is free to switch to other protocols (like FTP).
    • This may be the easiest and most flexible option. A downside is the program must support the HTTP protocol for the initial CONNECT, in addition to its FTP support.
    • More details: http://en.wikipedia.org/wiki/HTTP_tunnel#HTTP_CONNECT_Tunneling
  • Other methods referenced in Filezilla. I haven't found explanations for these yet.
    • USER@HOST
      • Command order (commas not literal): USER %s, PASS %w, USER %u@%h, PASS %p, ACCT %a
    • SITE
      • Command order (commas not literal): USER %s, PASS %w, SITE %h, USER %u, PASS %p, ACCT %a
    • OPEN
      • Command order (commas not literal): USER %s, PASS %w, OPEN %h, USER %u, PASS %p, ACCT %a
  • Vendor List

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .