Blocked outgoing FTP?

I am having problems with a programme supplied by Business Post. Atthe end of each day it FTP's a file to their FTP server. I have opened the firewall for local ip's addresses for ports 20-21 and I can sucessfully ftp files to my isp using manual ftp commands. However, when I try the same to Business-Posts ftp server it places a 0 byte file. Their technical chaps say it is because of my firewall, and there must be some truth in that because we never had a problem when we were using my old Cobalt Qube.

What am I missing here?

PowerMac G5, iMac G5, iMac G4, etc, Mac OS X (10.4.10)

Posted on Sep 4, 2007 2:19 PM

Reply
4 replies

Sep 4, 2007 4:56 PM in response to Paul Reading2

FTP has to be one of the least reliable, most insecure, and most firewall-unfriendly protocols around. I hope the data you're transferring isn't private or business-criticial. If it is and that's all they offer then shame on them.

That said, the problem almost certainly is the firewall. FTP uses port 21 for control and either port 20 or some random port for data, depending on whether you're using passive FTP or not.

Without knowing the app in question, it's hard to tell how to toggle passive FTP. It may honor the system setting (System Preferences -> Network -> (interface) -> Proxies -> Use Passive FTP), so that would be the first place to look. Otherwise you need to edit your firewall rules to be more permissive in the traffic it will allow to/from their server address (which has other security implications). Generally, if the FTP client doesn't use port 20, it will use any random port number above 1024, but clearly you don't want a blanket firewall rule that allows all traffic (you might as well not use any firewall at all).

If toggling Passive FTP doesn't work, find out from them whether they have any controls for the port numbers to use. Since they've chosen to use FTP they should be prepared to help users with the baggage that comes along with it.

Sep 4, 2007 6:15 PM in response to Paul Reading2

Ask Business Post folks nicely if there is a way to switch over and use sftp for the file transfer. It's easier to manage sftp than ftp; firewalls and ftp don't go together all that well: {shudder}. sftp is also more secure.

As for the immediate case, you'll end up finding which range the remote servers are looking for; what traffic is passing through the firewall. Many FTP servers have a range of ports configured or configurable; often up in the ephemeral range. You might end up switching off outgoing blocks and switching on whatever sort of port monitoring might be available; this will give you an idea of where the ports are lurking. But these can be all over.

Here's a decent discussion of various different ftp transfer modes:

http://www.troubleshootingnetworks.com/ftpinfo.html

Here are the gnarly details of ftp:

http://www.faqs.org/rfcs/rfc959.html

Sep 4, 2007 10:46 PM in response to Camelot

I too was suprised that they use this method of data transfer, the other option to a daily floppy disk to give to their driver doh!

Am I mising something I would have thought opening ports 20 & 21 for outgoing traffic would not give me a security problem. I will trythe passive seting, I am sure i is something as simple as that. As for the technical bods at Business post he told me he could not help as I was using a Mac!

Sep 5, 2007 10:45 AM in response to Paul Reading2

+As for the technical bods at Business post he told me he could not help as I was using a Mac!+

Ah, a very simple mistake. Don't volunteer "Mac" in this particular context. It's actually arguably not relevant here; it's centrally the particular ftp client and ftp server involved here, and there are a gazillion of those combinations around. If switching ftp over to passive transfers doesn't drill through -- and it might not -- tell the Business Post folks you have your server(s) behind a firewall, and that your IT team restricts outbound traffic and particularly ftp traffic. Ask what ports you need to open on the firewall, as you'll need to provide that to the network administrator. (Your "IT team" might well be you, but then you don't have to volunteer that detail, either.)

And do ask the folks if they have sftp capabilities -- that really is easier to wire up, and we can help you get an outbound sftp connection established; to get your certificates registered for batch-oriented no-password file transfer operations. The design of ftp predates firewalls and such, and it's somewhat gnarly to get it through a firewall and keep the firewall locked down. Having to open the ephemeral ports outbound is tantamount to opening up the firewall for all outbound traffic. sftp can be punched through a firewall far more easily.

I've also seen folks push files via a web interface, and that too works nicely.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Blocked outgoing FTP?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.