Firewall and FTP

I have failed in using a number of FTP apps. Cyberduck and Fetch will work but only if I turn off the firewall. I have tried toggling passive/active. I presume I must be missing a trick here. Is there a way to use these without switching off the firewall?
Mike

I have observed something similar tonight. I want to be able to access my iMac remotely using FTP. So, I have set up my System Preferences/Sharing/Services to enable FTP Access. That opens up port 21 through the OS X firewall. Following the instructions, I have confirmed that, in System Preferences/Network/AirPort/Proxies, the box for "Use Passive FTP Mode (PASV)" is checked. In my AirPort Base Station configuration, I have port 21 (and 20, for good measure) forwarded to my iMac (at 192.168.1.2).
I have a Motorola SB5101 cable modem (no built-in router functionality), an AirPort Extreme Base Station (firmware version 5.7). My iMac is connected using AirPort, not an ethernet cable.
Here's the interesting part: using Cyberduck, or using the command-line ftp client through terminal, I can connect to my "local" IP address (192.168.1.2, inside my local network) just fine. However, if I try to ftp to my "external" IP address (the address assigned to my AirPort Extreme base station by my ISP), which should be forwarded on ports 20 and 21 to my iMac, it doesn't work if the OS X firewall is on. I can reach the server and log in, but cannot get an 'ls' to work. It goes into "extended passive mode" and just hangs there. Cyberduck tells me there's a username/password problem, but I don't believe that based on what I've seen in the command line ftp client.
If I turn the OS X firewall off completely, it works like a charm.
I'm not really too worried, because I had someone else (outside my local network) create an ftp connection to my AirPort's IP address, and they were able to log in and see files using the ftp client built into Finder. So the port forwarding is working, and the firewall is not blocking them.
Just to recap: Using several ftp clients, including two included with OS X, I can't create an ftp connection with the OS X ftp (tnftpd) server running on the same machine, if I ask the client to go out and come back in through the IP assigned to me by my ISP, as long as the OS X firewall is on. But, someone else can connect to my system from "the outside" when my firewall is on.
Does this make sense to anyone? Why would this be, and could it be related to the issue raised by the original poster in this thread?
Thanks.

Similar Messages

PI 7.1 and FTPS

We have configured a scenario to get Credit Card files from American Express using the File adapter with FTPS. We have added the CA-certificate to the keystore and all seems to be allright (green traffic light on the communication channel monitor, no errors in the logs in NWA), except.... no file gets picked.
When we try the same with a FTP client on the server where PI has been installed we can pick up the files without any problem.
Does anyone have a clue?
Kind regards,
Frank.

Frank,
Correct me if I am wrong - you are able to do FTP from PI server, but when it comes to FTPS from the File server (which, I assume, is out of firewall and at client's site), then you are unable to pick the files. Right?
There is a possibility that there can be issues with the permissions to the user being used or the directory is restricted.
Do check the adapter monitoring in RWB and the detailed log in NWA ... share the details so that some one can help you out.
Regards,
Neetesh

SAP XI support SFTP and FTPS?

Hi Gurus,
I would like to find out if SAP XI supports both SFTP and FTPS. If yes, how do I perform the configuration?
Thanks in advance.

Business Case:
In many implementations Business requirement is to "secure" the file/data transfer between XI and any third-party system. So there is a need of secured connection between XI/PI and any file based third-party legacy systems.
Following solutions are proposed to cater secure connection between XI/PI and any third party systems.
1) SFTP (Secure File Transfer Protocol)
"SSH File Transfer Protocol" or SFTP is a network protocol that provides file transfer and manipulation functionality over any reliable data stream. It is typically used with the SSH-2 protocol to provide secure file transfer. SFTP encrypts the session, preventing the casual detection of username, password or anything that is being transmitted. One key benefit to SFTP is its ability to handle multiple secure file transfers over a single encrypted pipe. By using a single encrypted pipe, there are fewer holes in the corporate firewall.
2) FTPS (FTP over SSL)
FTPS (FTP-SSL) is a real ftp that uses TSL/SSL to encrypt the control session and if required the data session. With FTPS, the control session is always encrypted, but the data session may not be always encrypted. FTPS is a file transport layer on top of SSL. SSL, or Secure Sockets Layer, is a method by which an encrypted u2018pipe' or tunnel is established between the FTP client and FTP server. Once the secure tunnel has been established (which is done using 128-bit encryption techniques), standard FTP is used to transfer data over the secure connection.
Feasibility of SFTP and FTPS in XI:
SFTP:
As per the latest SAP PI/XI support pack, it does not support SFTP via File Adapter.
So alternative approach to cater this requirement from XI is to make use of Unix Script at OS level to transfer the files from/to third-party systems.
Inbound Interface - i.e. third-party system ->XI->SAP:
File is transferred to a folder in SAP XI landscape from the third-party legacy system using UNIX Script with secured protocol. Once the file is ready in the XI landscape, File Adapter will poll this directory and file is picked up by NFS protocol.
Outbound Interface u2013 i.e. SAP->XI->third-party system:
XI is responsible for writing a file into a folder in the XI landscape. These files are transferred to the third-party system by executing UNIX scripts with secured protocol i.e. via sFTP.
Pre-Requisites:
Public key should be exchanged between external systems and the PI system.
UNIX shell script has to be developed and scheduled.
Advantages:
Highly Secured.
Ability to handle multiple secure file transfers over a single encrypted pipe .By using a single encrypted pipe, there are fewer holes in the corporate firewall.
Disadvantages:
Two-Step process i.e. XI>Temporary folder>External System and vice-versa
Files have to be temporarily stored in XI server.
Multiple failure points i.e. XI and Unix script execution
Maintenance of an external UNIX script.
Difficulty in monitoring the execution of the shell script as it cannot be monitored thru XI.
Need to generate keys and install it in the SFTP site as a pre-requisite i.e. SFTP clients must install keys on the server.
SFTP uses keys rather than certificates. This means that it can't take advantage of the "chains of trust" paradigm facilitated through Certificate Authorities.
Files from the XI server should be deleted/archived in a periodic manner to increase the disc space so that it will increase the performance.
Note: UNIX shell Script can be executed as a background job u2018or' can be triggered from SAP XI through OS command at File adapter level.
FTPS (File Transfer Protocol Using SSL/TLS):
This is a built-in feature of File adapter in XI. But SAP Java Cryptographic Toolkit must be deployed as a prerequisite. (Refer to note https://service.sap.com/sap/support/notes/821267 Question 28). By default following ports are used:
Implict FTPs 990 (Control) and 989 (Data)
Explicit FTPs 21 (Control) and 20 (Data)
Both use cases can be combined with active and passive mode.
Advantages:
Direct transfer of files to/from third-party systems. It is not required to store the files in the XI server temporarily.
Built-In feature from XI File adapter
No extra effort in development and maintenance of Unix Script.
Centralized Monitoring tool from XI
FTPS uses certificates and therefore can take advantage of "chains of trust" paradigm facilitated through Certificate Authorities. This paradigm makes it possible for two entities to establish a trust relationship without directly exchanging security information, which is important for some applications.
Disadvantages:
Requires opening multiple ports forenabling SSLin the firewall. So there are multiple holes in the corporate firewall.
Not every FTP server supports FTPS and many that do, require a configuration change to activate the FTPS protocol extension.
Cryptographic toolkit should be installed in XI system though it is not very complex or expensive.
Conclusion:
Though SFTP seems more secure as it works through one port, FTPS is easier to configure, monitor and maintain from XI point of view. However, the decision depends on many parameters like, cost/effort, flexibility in use, ease of maintenance, company security policy, failure possibilities etc.
regards
kummari

Help needed with Firewall and pureftpd

I am having trouble getting the Leopard Firewall to let through ftp connections with PureFTPD manager 1.7
On a clean install of Leopard I set the firewall to "Set access for specific services and applications". For ssh, and apache (web sharing) this worked just fine.
I then installed PureFTPD Manager 1.7 (The version that is supposed to work with Leopard).
However I have been unable to get the firewall to let through connections to the pure-ftpd server.
I selected "allow" when OSX prompted me whether ProFTPD should be permitted to open a port. That worked right after I installed ProFTPD Manager until I reset the computer. Then it stopped working.
I tried adding the pure-ftpd application to the application list in the Firewall settings. That didn't work.
I always get "Deny pure-ftpd connecting from ..." in the firewall log.
Has anyone out there gotten pro-ftpd to work with the Leopard firewall set to "Set access for specific services and applications?"
Please don't suggest to disable the firewall or to use ipfw. Disabling the firewall I don't consider a reasonable solution for a computer that is exposed to the internet, and I would prefer not to have to use ipfw for everything.
Thank you

I'm assuming that this works fine if you disable the firewall altogether, correct?
ipfw won't help you here since the way that the leopard firewall is setup, it's already set as an 'allow all'.
Rather than waiting for the 'do you want to allow...' dialog to come up, have you tried clicking the + in the firewall and adding the application directly?
Also, can you describe how you are performing your tests? From the same system or a different system? From behind a router/firewall or on the same segment?
You may also want to read through this post on how the firewall works. It sounds like you already understand 99% of it though. http://discussions.apple.com/thread.jspa?threadID=1337153&tstart=0#6317068
One last resort option would be to delete the firewall preference file and reboot to start over.
You'd want to nuke /Library/Preferences/com.apple.alf.plist

Enabling telnet and ftp on M4000 wth solaris 10

hi all,
please i need help i have installed solaris 10 on M4000 and i have enabled telnet in /etc/default/logins and ftp in ftpusers but i am not able to telnet and ftp??
i did some research and i found that it may be the firewall???
please i need help
Thx

Hi
Have you tried connecting from another host on the same subnet as this problematic system or are you coming from another subnet? You may have a software firewall installed. Sun were touting SunScreen up until Sol10:
http://docs.sun.com/app/docs/coll/557.4
You could also try running nmap from another host, see if any other ports are available although check you're not violating any security policies beforehand.

Dreamweaver CS3 (9) maxed CPU slow performance and FTP issues.

Dreamweaver CS3 (9) maxed CPU slow performance and FTP
issues.
Never mind...I found it.
Of course I have all the firewall, worm, scanning, phishing
filtering, full time protect, and everything else turned off when I
am working on a remote/testing site however I found the Symantec
antivirus email scan being enabled (doesn't it just interact with
my email program?) was getting in the way of DW9 ftp operations,
causing some lagging that was putting DW9 into an unstable mode
during and immediately after (10 seconds) ftp operations.
The CPU still spikes to 99% during ftp functions but DW9
works even though it's likely taxed to the max but when I turn off
email scan DW9 returned to a functioning state during ftp and
remote file view. Whatever it takes huh?
PS: email scanning only never effected DW8.02
My System Info: properly configured (as in: everything works
or I fix it) Toshiba - XP pro SP2 – Pentium 4 - 2.3GHz
– 1.5 GB ram – Intel extreme graphics card 64 MB ram
– Apache 2.2 server – PHP 5 – MySQL 5 -
phpMyAdmin – Dreamweaver 8.02 – Interakt Kollection
3.7.1 – Dreamwweaver 9 - DeVtoolbox – Flash –
GoLive - Photoshop - ImageReady – Illustrator – Acrobat
– CuteFTP – Putty SSH - blabla...)

Thanks for the response. I managed to Google the 'nobody' account and found the explanation.
As you say, I assumed the 'syslogd' process had to do with system logs. I did check the console and couldn't find anything of particular interest in the logs.
I'll continue to monitor but if anyone has any further suggestions please post.
One thing that might also have an impact... my available drive space is now down to less than 5gb (runs anywhere between 1gb and 5gb free depending on what I'm running). I know this causes problems for Parallels as it keeps moaning at me, but would it cause any problems with OSX?
Thanks again,
Tom

Error message about firewall and internet sharing

hello all i have a question regarding the use of firewall and internet sharing.
I have a PMG5 connected to internet through Airport. I've linked an Xbox 360 via the built-in ethernet port in order to access Xbox Live. I had to open specific UDP ports on the OS X firewall but it now works fine. However, in the Sharing Preference Pane, Internet Tab, i still get an error message saying that my Internet Sharing is disturbed by the settings of the firewall and sharing services, it says that i did not activate "personal web sharing" in the first two tabs...but i DID ! And there's no way to get rid of this error message.
I know I know some may consider it's not a real problem because it's just an error message while the connection actually works fine but well, I tend to hate error messages when they're not supposed to show up. So if anyone know the answer, thanks in advance...
Good day to everyone
Vince, Paris...

sorry about the delay in replying, was kinda busy
well trashing the pref files was useless and i tried with another user, same thing. As for the second opinion, the problem was not about which port was used cause as i said the connection sharing works fine and anyway it was the correct port that was checked, it's just that i get an error message while there is no apparent error and everything works fine, i'm told that personal web sharing is not enabled but it is...
Anyway as i said, it's probably not a real matter, as long as it works...which brings me to another thing. I've created a special protocol in the firewall to enable a proper dialog with the xbox. it's basically the same thing you do for ichat AV when you have video connection problems, you track down the concerned UDP port using terminal, you allow traffic and all... The protocol for the xbox worked great for some days, but now it seems it's not enough, the game set keeps trying on another port and i constantly have to update the protocol or deactivate the firewall...and enabling back all UDP traffic is not enough to solve it.
In a way i think everything is linked, the initial error message when everything was fine and the current trouble. Any idea?
thanks
Vince

I am getting an error message that my network connection has timed out. while trying to update my iPhone on iTunes. Has anyone found a solution? I was given some advice about turning off my firewall and/or virus protection but am nervous about doing that.

I get a message that my network connection has timed out while trying to update my iPhone on iTunes. Has anyone else had that problem and if so what solutions have you found? I was told to turn off my firewall and/or virus protection while updating but am nervous about doing that for obvious reasons. I'm also disgusted with Apple not providing free tech support.

See this article about the ports that have to be open during the update process. iTunes has to contact Apple during the download. iTunes for Windows: Troubleshooting security software issues

I have disabled all Kaspersky security, windows firewall and windows defender and Itunes still will not update my Ipod touch 4th gen to IOS 5, Helppppp!

I can't get the IOS 5 to work for windows Vista. I'm running kaspersky pure 2.0, windows firewall and windows defender. I have turned them all off, I then attach my Ipod 4th gen and I get the "cannot connect to itunes update server". I ran diagnostics in itunes and it tells me I dont have a internet connection. I'm on the internet right now, and I DO have a internet connection, but it tells me Itunes says otherwise. I'm able to send this message on the same pc with internet connection but keep running into this error. I have now read discussiong boards through apple and disabled all my firewalls, still no luck. I was able to update the lates version of itunes, and just waiting to get my ipod updated now, please help me.

On the computer you should be able to go to the network properites. Go to the TCP part and unchec the line that says obtaind DNS automatically and check the one that says use the following. Add the 8.8.8.8 and Google other 8.8.4.4.
For more info see:
https://developers.google.com/speed/public-dns/

HT203200 Have deleted temp video, configured anti spam and firewall, and one specific video keeps giving me an error. Just tried downloading a previous episode of the show and it worked just fine. Always sunny in philly "Charlie rules the world" anyone el

Have deleted temp video, configured anti spam and firewall, and one specific video keeps giving me an error. Just tried downloading a previous episode of the show and it worked just fine. Always sunny in philly "Charlie rules the world" anyone else??

Have deleted temp video, configured anti spam and firewall, and one specific video keeps giving me an error. Just tried downloading a previous episode of the show and it worked just fine. Always sunny in philly "Charlie rules the world" anyone else??

Web host, mail server and FTP.

Dear all:
I have some questions and will try to make my post a short one (although the questions aren't exactly simple). I have the need to set up my own web server, e-mail server and FTP server. It is my understanding (and I remember setting another computer I had 2 or 3 years ago this way) that OS X can be used for this without the need to have OS X server installed. I don't need (at least not for the for the immediate future) to have a server for my own local network. Basically all I need is a single computer where (1) I can host multiple web sites, (2) I can host my own e-mail that will correspond in number to the number of web sites (domain names) being hosted and (3) I can set-up as a FTP server so that my clients can log on and download files.
I have used VirtualHostX for virtual hosting as well as PureFTD Manager with good results in the past. I've also found both to be easy to use, with a good and intuitive GUI which is essential for someone with as little knowledge as I have of networking. My question now as to do with e-mail and how to set-up Mac OS X to work as an e-mail server.
Are there any applications you would suggest that would be simple to use, have a simple and intuitive user interface and also provide mailing list services along with e-mail services that you would recommend ? I've looked at a few but most of the ones I have found seem to require command line input and this is something I am not comfortable with. I need an application with a simple interface and allows things to be set-up in a straight forward manner (and preferably free instead of paid).
What would be your recommendations for this project ? Any recommendations, advice and suggestions you can offer will be very appreciated.
Thank you in advance,
Joseph

Perhaps you should give people more time to answer.
1. You do not need a DNS on your server, ask the ISP to set up the MX record as they set up the A record.
2. Not really enough information in your setup to say either way, but as it takes seconds to do and you have everything else needed - set it up anyway.
3. Domain name: mydomain.com, Host name depends what you call it. If you don't have a name why not mail.mydomain.com and make you mx record point to that name. Perhaps that is what your A record is already.

Http and ftp protocol extremely slow (pop working well though)

Hello. Starting today, on one of my macs, http and ftp protocol are extremely slow (page load 90 sec. instead of 2) (pop working well though). Provider finds nothing, on second mac all is fine (same cable, same settings … ). Cable connection, checked both sockets, changed cable, no change. Since pop3 protocol seems to work fine, this does look like a software problem to me. (Repaired permissions, no other tests or means. All used software up to date (OSX10.6.8 etc.))
I'd be thankful for any idea.

Not at all. Then I turned on NetBarrier, for testing and to avoid any damage (piece of software I don't employ in vain), and all slowed down again, but not quite as badly as before. Restarted, and now it seems back to normal with all extensions loaded. (I had done that before, obviously, and with no outcome, so it can't very well have been just that. But what?)
I'll watch and learn, and report back; unless you have any further suggestions for the moment. Either way, thankyou very much so far.

FILE and FTP Adapter file size limit

Hi,
Oracle SOA Suite ESB related:
I see that there is a file size limit of 7MB for transferring using File and FTP adapter and that debatching can be used to overcome this issue. Also see that debatching can be done only for strucutred files.
1) What can be done to transfer unstructured files larger than 7MB from one server to the other using FTP adapter?
2) For structured files, could someone help me in debatching a file with the following structure.
000|SEC-US-MF|1234|POPOC|679
100|PO_226312|1234|7130667
200|PO_226312|1234|Line_id_1
300|Line_id_1|1234|Location_ID_1
400|Location_ID_1|1234|Dist_ID_1
100|PO_226355|1234|7136890
200|PO_226355|1234|Line_id_2
300|Line_id_2|1234|Location_ID_2
400|Location_ID_2|1234|Dist_ID_2
100|PO_226355|1234|7136890
200|PO_226355|1234|Line_id_N
300|Line_id_N|1234|Location_ID_N
400|Location_ID_N|1234|Dist_ID_N
999|SSS|1234|88|158
I would need a the complete data in a single file at the destination for each file in the source. If there are as many number of files as the number of batches at the destination, I would need the file output file structure be as follows:
000|SEC-US-MF|1234|POPOC|679
100|PO_226312|1234|7130667
200|PO_226312|1234|Line_id_1
300|Line_id_1|1234|Location_ID_1
400|Location_ID_1|1234|Dist_ID_1
999|SSS|1234|88|158
Thanks in advance,
RV
Edited by: user10236075 on May 25, 2009 4:12 PM
Edited by: user10236075 on May 25, 2009 4:14 PM

Ok Here are the steps
1. Create an inbound file adapter as you normally would. The schema is opaque, set the polling as required.
2. Create an outbound file adapter as you normally would, it doesn't really matter what xsd you use as you will modify the wsdl manually.
3. Create a xsd that will read your file. This would typically be the xsd you would use for the inbound adapter. I call this address-csv.xsd.
4. Create a xsd that is the desired output. This would typically be the xsd you would use for the outbound adapter. I have called this address-fixed-length.xsd. So I want to map csv to fixed length format.
5. Create the xslt that will map between the 2 xsd. Do this in JDev, select the BPEL project, right-click -> New -> General -> XSL Map
6. Edit the outbound file partner link wsdl, the the jca operations as the doc specifies, this is my example.
<jca:binding />
        <operation name="MoveWithXlate">
      <jca:operation
          InteractionSpec="oracle.tip.adapter.file.outbound.FileIoInteractionSpec"
          SourcePhysicalDirectory="foo1"
          SourceFileName="bar1"
          TargetPhysicalDirectory="C:\JDevOOW\jdev\FileIoOperationApps\MoveHugeFileWithXlate\out"
          TargetFileName="purchase_fixed.txt"
          SourceSchema="address-csv.xsd"
          SourceSchemaRoot ="Root-Element"
          SourceType="native"
          TargetSchema="address-fixedLength.xsd"
          TargetSchemaRoot ="Root-Element"
          TargetType="native"
          Xsl="addr1Toaddr2.xsl"
          Type="MOVE">
      </jca:operation> 7. Edit the outbound header to look as follows
    <types>
        <schema attributeFormDefault="qualified" elementFormDefault="qualified"
                targetNamespace="http://xmlns.oracle.com/pcbpel/adapter/file/"
                xmlns="http://www.w3.org/2001/XMLSchema"
                xmlns:FILEAPP="http://xmlns.oracle.com/pcbpel/adapter/file/">
            <element name="OutboundFileHeaderType">
                <complexType>
                    <sequence>
                        <element name="fileName" type="string"/>
                        <element name="sourceDirectory" type="string"/>
                        <element name="sourceFileName" type="string"/>
                        <element name="targetDirectory" type="string"/>
                        <element name="targetFileName" type="string"/>
                    </sequence>
                </complexType>
            </element>
        </schema>
    </types>   8. the last trick is to have an assign between the inbound header to the outbound header partner link that copies the headers. You only need to copy the sourceDirectory and SourceGileName
    <assign name="Assign_Headers">
      <copy>
        <from variable="inboundHeader" part="inboundHeader"
              query="/ns2:InboundFileHeaderType/ns2:fileName"/>
        <to variable="outboundHeader" part="outboundHeader"
            query="/ns2:OutboundFileHeaderType/ns2:sourceFileName"/>
      </copy>
      <copy>
        <from variable="inboundHeader" part="inboundHeader"
              query="/ns2:InboundFileHeaderType/ns2:directory"/>
        <to variable="outboundHeader" part="outboundHeader"
            query="/ns2:OutboundFileHeaderType/ns2:sourceDirectory"/>
      </copy>
    </assign>you should be good to go. If you just want pass through then you don't need the native format set to opaque, with no XSLT
cheers
James

When I try to download iTunes 10.5.3.3 it says "A program required for this install to complete could not be run...." I have uninstalled itunes, restarted my pc, disabled firewall and antivirus. HELP

I used to have iTunes 4.3.1, something like that, it kept asking me to upgrade but i had an older ipod so i couldnt. I recently broke my ipod so now i have one for itunes 10.5.3.3 because my ipod came shipped with ios5.0 installed. So i tried to update itunes, didnt work. I uninstalled it, didnt work. I disabled firewall and antiviurs, didnt work. Ive called tech support, as soon as the person hung up thinking that it was working, it stopped working. I REALLY LOVE MUSIC and want songs on my new ipod. Please someone help....

First try removing and reinstalling all the Apple software using the following or the link within it that applies to XP.
Removing and reinstalling iTunes, QuickTime, and other software components for Windows Vista or Windows 7
Then try the other items in:
iPhone, iPad, or iPod touch: Device not recognized in iTunes for Windows

Unable to receive internet connection over wifi connection. Shows that I am connected to the network, but do not have internet access. Checked my firewall and turned it off. What else am I missing or should be doing differently?

Unable to receive internet connection over wifi connection. Shows that I am connected to the network, but do not have internet access. Checked my firewall and turned it off. What else am I missing or should be doing differently?

You might want to try resetting your router and your modem - just unplug the cords, leave them unplugged for about 3-5 minutes and then replug the modem and then the router in that order.
This may or may not correct your problem - call back if it doesn't.
Clinton

Firewall and FTP

Similar Messages

Maybe you are looking for