Active vs. Passive FTP?

Can someone explain in lay terms the difference?

bobtem wrote:
> Can someone explain in lay terms the difference?
Try this:
http://slacksite.com/other/ftp.html
In my experience, if you have a router or firewall on your
computer or
network, then you should select passive.
If your ftp server is on the same physical network as your
client, then
use passive. This is because there are no firewalls blocking
access to
the random ports that the ftp server will open for the
client.
Dooza

Similar Messages

Active and Passive FTP

Hi
I want to setup an Passive FTP and an Active proxy service in Oracle Service Bus 10.3. What is the best way of doing this?
Regards

see support note 860423.1
Oracle Service Bus FTP transport is implemented to use passive mode in proxy services (inbound) and active mode in business services (outbound).
This behavior can be changed and OSB can be forced to use passive mode for both inbound and outbound FTP requests by applying a patch.

Let's Revisit MacOS Server's Passive FTP Problem

Mac OS X Server's built-in FTP server can't be configured to determine which ports above 1024 will be used for Passive FTP connections. More often than not, this means that clients behind NAT routers (for a variety of complicated reasons) can't discover which of the "high ports" are being used in their passive connection. Furthermore the Mac OS X administrator would have to open every port above 1024 to anticipate connections, severly weakening the security of the system.
The effect for the user is that their FTP client can connect, but can't list the contents of a directory or upload/download anything.
Here's a primer on the difference between Active and Passive FTP:
http://slacksite.com/other/ftp.html
Apple introduced a "solution" to the problem by making this addition to the Network Services manual sometime around 10.3 server:
"See if the client is using FTP passive mode, and turn it off. Passive mode causes the FTP server to open a connection on a dynamically determined port to the client, which could conflict with port filters set up in IP filter service. "
This was a tacit admission that MacOS's various FTP daemons over the years have unchangeable, precompiled configurations. The typical workaround was choppy, but workable: replace Apple's built-in FTP daemon with a fully configurable one like ProFTPd or PureFTPd, configure a narrow range of ports for your own security, and configure your firewall to match.
We're on Tiger server now and that's still in the Network Services manual. Leopard or whatever is looming. Will Apple ship an FTP server that works out-of-the-box with its own firewall this time? Any new thoughts or solutions?

I think you need to do a little more research on FTP. Most of the actual problems you describe are inherent in FTP and nothing to do with any kind of Apple-inhibited FTP server.
For example, you say:
> Mac OS X Server's built-in FTP server can't be configured to determine which ports above 1024 will be used for Passive FTP connections
Not true. You can choose whatever port range you like using the portrange directive in /etc/ftpd.conf
By default this directive isn't set so the entire port range is used. Feel free to change that.
>The effect for the user is that their FTP client can connect, but can't list the contents of a directory or upload/download anything.
This is an inherent flaw in FTP, suffered by every FTP server on the market. Nothing to do with Apple.
> This was a tacit admission that MacOS's various FTP daemons over the years have unchangeable, precompiled configurations
Again, incorrect. The suggestion was a workaround for the FTP protocol restriction, not for Apple's implementation. I've been dealing with the exact same issues for years on various Sun servers I've run.
Most of the problems you describe regarding FTP and firewalls won't be solved at all in any future OS update - from any vendor. FTP was never designed with firewalls and security in mind. The only solution is to fix the underlying protocol, or use something different altogether.

OSB 11g - FTP Transport - Active or Passive connections?

Hi,
When we create a Proxy Service in OSB to use FTP transport, which type of connection OSB establishes with the server? Is it active FTP or passive FTP conecction?
Thanks,
Sanjay
Edited by: Sanjay Bharatiya on 20-Dec-2010 11:46 AM

OSB uses passive mode for proxy services and active mode for business services. There is a patch available which will make both proxy and business services to use passive mode. If you need the patch please open a Service Request in MyOracle Support and mention the support Note (860423.1)
Passive mode is desired if you want to open the firewall ports, if any, from OSB server to FTP server only and not other way from FTP Server to OSB server.

CSS and Extended Passive FTP problem.

Hi everyone.
I'm having a problem setting up a load balanced cluster of FTP servers behind a CSS 11506.
I can FTP into the cluster fine. I am redirected to one of the machines in a round robin fashion and can log in. The problem arises on mac's where typing in an ls command returns this:
ftp> ls
229 Entering Extended Passive Mode (|||32999|)
200 EPRT command successful
421 Service not available, remote server timed out. Connection closed
Now, if I type in the EPSV command and disable Extended Passive Mode prior to connecting to it, it works fine.
Also, connecting to any of the servers directly with epsv enabled works fine as well.
We have over 800k hits per month and telling everyone to disable epsv will be a problem. Is there a way to enable extended passive mode through the css?
Here is my config:
Group: ftpServers1 - Active (198.202.122.181 Not Redundant)
Session Redundancy: Disabled
Last Clearing of Stats Counters: 03/20/2007 14:28:25
Associated ACLs: NONE
Source Services:
DNS
Name: Hits: State: Load: Trans: Keepalive: Conn:
rem_ftp1 19857 Alive 44 6 FTP 0
rem_ftp2 38175 Alive 87 0 FTP 0
Destination Services:
NONE
Group Service Total Counters:
Hits/Frames/Bytes: 58032/58339/4277264
Connections Total/Current: 25/0
FTP Control Total/Current: 0/0
CSS11506# show rule pdb ftp-rule1
Name: ftp-rule1 Owner: pdb
State: Active Type: FTP
Balance: Round Robin Failover: N/A
Persistence: Enabled Param-Bypass: Disabled
Session Redundancy: Disabled
IP Redundancy: Not Redundant
L3: 198.202.122.181
L4: TCP/21
Url:
Redirect: ""
TCP RST client if service unreachable: Disabled
Rule Services & Weights:
1: rem_ftp1-Alive, S-1
2: rem_ftp2-Alive, S-1
Thanks
Boki

EPSV is not supported.
The only workaround available to load balance passive ftp servers is to use "PASV" command instead of "EPSV" on clients.
Syed Iftekhar Ahmed

Any way to set "active mode" for FTP, or to use sFTP instead?

I have a web host that does not support passive FTP mode. I need to either set the mode to be "active mode", or I need to use secure FTP (sFTP). Is there any support for either of these within Muse?

Hi
By default , Adobe Muse FTP option uses " Passive Mode" , I am afraid its not possible to switch to "Active Mode" or to switch to Secure FTP. Alternatively, you may export the site locally using " Export as HTML " and then you may use third party FTP client to upload the site to your third party hosting using Active or Secure FTP.
Let me know if you have any further query.

Switch over from active to passive in the cluster

If online EMS Sun Server goes off line , the client looses the connectivity with EMS till the IP address of the other online server is updated in client PC.
When the servers switch over from active to passive in the cluster, we have to change the server IP settings at the client PC manually. Since both the active as well as the passive servers will be pinging, we are not in a position to identify the active/passive servers, so automatic server setting is not possible at the client.
How to find out the solution for which server is active when the swich over is happend.

Hi Kristoffer,
remember to click on enable schedule when you schedule a package.
To know if a scheduled package is ok you can see first if present in the tblschedule of your appset and also if present in the windows task schedulerif with status "ready".
After you just have to check the view status if you found the package execution completed you're sure it's running. " version at the same time can cause issues also with different packages better to schedule with a sufficient delay to be sure that the first has ended, in your case 1 package is ok.
I would delete the 2 packages from bpc, checking also the windows scheduler to be sure that no packages are running and rebuild one from scratch setting repeat every 4 hours and checking "enable schedule".
Regards
Roberto

Passive FTP Port Range -- Server 10.3.x Panther

I know that the port range for Passive FTP is >1024, but I want to define that to a smaller group of unused ports so that I can specify that those ports are open in the Firewall.
Can, how, and where do I define this port range??

I just opened from 13658-65534 and this seems to be fine (although not been running very long). I took the view that opening a stack of ports was not really any worse than just opening a quarter as much. Arguably, it's no worse than just opening one.
However, we only use it from time to time and FTP services is off unless specifically required. If I was going to run it for serious use I think I would put it on a dedicated server and put it in a DMZ.
Reading up on FTP security is on my To-Do list...
-david
[EDIT] The server is also well locked down for SSH.

Help Toggling Passive FTP

I have a problem with my FTP server, or something. I have
created a site, set it up, where the files need to go etc., but
when I test my connection it times out and says to try toggling the
passive FTP mode. Where do I find this? I have looked everywhere
(or so I think).. any help is useful at this point.
Thanks
T.Sanchez

Site Definition > Advanced Tab > Remote Site
Likely that's not the problem, but give it a try....
Murray --- ICQ 71997575
Adobe Community Expert
(If you *MUST* email me, don't LAUGH when you do so!)
==================
http://www.projectseven.com/go
- DW FAQs, Tutorials & Resources
http://www.dwfaq.com - DW FAQs,
Tutorials & Resources
==================
"TSanchez012" <[email protected]> wrote in
message
news:fvfql1$r3l$[email protected]..
>I have a problem with my FTP server, or something. I have
created a site,
>set
> it up, where the files need to go etc., but when I test
my connection it
> times
> out and says to try toggling the passive FTP mode. Where
do I find this? I
> have
> looked everywhere (or so I think).. any help is useful
at this point.
>
> Thanks
> T.Sanchez
>

ACE access-list and Passive FTP

Can servers sitting behind the ACE successfully ftp files if the following rules are in place?
access-list word line x extended permit tcp source destination eq 21
access-list word line y extended permit tcp source destination eq 20
With those lines I can establish an FTP session, but unable to transfer files.
With the following statement access-list word line x extended permit ip source destination, passive ftp works?
IS this because the ACE acl does not allow for stateful inspection of an FTP session?
Thank you

You are right lack of fixup/inspect is the reason for FTP connections to fail.
You need something in line with the following config
class-map match-all FTP-Traffic
2 match port tcp eq ftp
policy-map multi-match xyz
class FTP-Traffic
inspect ftp
Syed Iftekhar Ahmed

Passive FTP and the Leopard firewall

Hi,
We have an staff upload server that uses the built-in Leopard firewall. It is fed by two proprietary applications, one of which uses passive ftp only. We are getting a small number of incidents where the passive upload is unsuccessful. Initial contact is made (visible in the logs and as a connection in the server admin gui) but the upload doesn't proceed. A user might try uploading several times without success. On other occasions, the same user from the same computer has no problems at all.
We have the ftp service enabled on port 20-21 and the FTP service PASV port range enabled 49152-65535.
If I add the uploading computers' ip number to an access group with no port restrictions on the firewall, the uploads are always successful.
With my very limited knowledge of ftp and firewalls, this suggest that the negotiated port for the data transfer is outside the default port range used by Apple. Is this likely? Are there any implications in changing the range?
Or am I totally confused and should I be looking elsewhere?
Thanks,
Ross Glover

By default, the FTP server doesn't restrict itself to any particular passive port range. To make it match what the firewall claims it should be, edit the file /Library/FTPServer/Configuration/ftpaccess and add the line:
passive ports 0.0.0.0/0 49152 65535
...then restart the FTP service and retest.

AIR installer Passive FTP?

Our AIR app uses the AIR badge installer to update our client's desktop app. However, we've noticed a lot of our users get these half-baked installer files (literally, the installer file they get is half the size of what it should be). The cloud server hosting the installer is fine, the file itself is fine, but people aren't getting the whole file.
Is there a setting on AIR's installer to use passive FTP? Or some way to guarantee the user actually gets the entire file? Is this a known issue with the installer badge?
Thanks!

Hi,
There is a bunch of ftp libraries that support passive transfer.. Use google, or look at the following link:
http://freshmeat.net/projects/javaftp/
/Kaj

About passive ftp mode?

In proxies passive ftp mode is checked and in the box this domain*.local, 169.254/16 is always visible. My internet is dongle wifi - Wimax. Can I uncheck this box without it affecting my wifi connection.
Something very strange is happening when I connect via wi fi to my wimax. My airport menu show I am connected to uroad458930 which is my correct network address but there is also another network showing uroad458931. This address is only visible when I connect to my Wimax. Both addresses disappear from the menu when I switch off the wimax dongle and both appear when I switch it on.

Thank you for your answer.
Yes, according to those slides it looks like PASV mode is tried first...
But why do I get the following exception?
sun.net.ftp.FtpProtocolException: PORT :500 Illegal PORT command, EPSV ALL in effect
at sun.net.ftp.FtpClient.openDataConnection(FtpClient.java:381)
     at sun.net.ftp.FtpClient.get(FtpClient.java:485)
     at sun.net.www.protocol.ftp.FtpURLConnection.getInputStream(FtpURLConnection.java:284)
     at imageviewer.threads.DicomDirLoaderThread.run(DicomDirLoaderThread.java:124)
     at java.lang.Thread.run(Thread.java:534)
If I write the FTP URL that I use in my Java code in my browser's address bar, the file is regularly downloaded.
Any help / suggestion would be greatly appreciated.
Thank you,
Marco.

Document Splitting - Active and Passive

Hi,
What is the difference between active and passive split?? Please explain with an example.
Regards
Satya

Active document splitting means document splitting basing on the Business Transaction/Transaction Variant assigned to the document type and the Item Category assigned to the GL account. System determines and does the splitting of each line item in the document, basing on the configuration you have done. You have control over active splitting.
Passive splitting is something that you do not have control over. System takes the document splitting characteristics from the original document that it is referencing, for example, a reversal document that always references to the original document that is being reversed. The configuration that you do does not affect passive splitting.
See the following example.
http://help.sap.com/erp2005_ehp_04/helpdata/EN/49/11da8b97244a19e10000000a42189b/content.htm

Passive FTP in PIX 6.3(5)106

Dear All,
How can I allow passive ftp communication in PIX 6.3(5)106.
Thank You,
Abhisar.

Is this for outbound or inbound FTP?
For outbound FTP:
1) Configure:
fixup protocol ftp 21
2) Then if you have any access-list on the inside interface, allow tcp/21
For inbound FTP:
1) Configure:
fixup protocol ftp 21
2) Configure static NAT statement for the FTP server
3) Configure access-list on the outside interface to allow TCP/21 on the NATed IP.

NBAR discovery passive ftp

Hi guys,
I am trying to shape all ftp traffic on a 3700 router connecting to a LAN.
so F0/0 is the WAN and F0/1 is the LAN port.
I have tried to use NBAR to shape http or any traffic, all working fine.
however, it seems like I am having problems dealing with passive ftp traffic.
the following is part of the configuration I have :
class-map match-any FTP
match protocol ftp
policy-map FTP
class FTP
shape average 400000
int f0/1
service-policy output FTP
ip nbar protocol-discovery
end
wr
I am using an old version ios 12.3(22) on this router, I am wonderring if this ios's nbar supports passive ftp discovery or not.
thanks.

Hi,
Have a look at this link
http://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html#passiveftp
You may need to an access list to define the ftp-passive type traffic and apply the access list to your class map
Regards
Alex

Active vs. Passive FTP?

Similar Messages

Maybe you are looking for