RE: trouble using ftp.exe to connect to external site

Hello Thomas,

Thank you for posting here.

According to your description, I understand that you can access external
FTP site thru IE but cannot access thru ftp command line. If I have
misunderstood the problem, please don't hesitate to let me know.

Based on my research, I think this issue is caused by the different FTP
modes (Active and PASV). In SBS environment, we recommend to access
external FTP thru PASV mode. It is safe for internal computers and we do
not need to configure port forwarding rule on router and SBS.

FTP supports two modes - Standard (or Active) and Passive (or "PASV"). The
Standard mode FTP client sends PORT commands to the FTP server. The
Passive mode client sends PASV commands to the FTP Server. These commands
are sent over the FTP command channel. The following is the detailed
information:

Standard mode FTP clients first establish a connection to TCP port 21 on
the FTP server. This connection establishes the FTP command channel. The
client sends a PORT command over the FTP command channel when the FTP
client needs to receive data, such as a folder list or file. The PORT
command contains information about on which port the FTP client receives
the data. In PORT Mode, the FTP server always sends data from TCP port 20.
The FTP server must open a new connection to the client when it sends data.

Passive mode FTP clients also start by establishing a connection to TCP
port 21 on the FTP server to create the control channel. When the client
sends a PASV command over the command channel, the FTP server opens an
ephemeral port (between 1024 and 5000) and informs the FTP client to
request data transfer from that port. The FTP server responds to the
request by using the ephemeral port as the source port for data transfer.
When this occurs, the FTP server does not need to establish a new inbound
connection to the FTP client.

By default, the IE will work at PASV mode, and the FTP command line will
work at Active mode. Therefore, you can access external web site thru IE
but not command line.

Therefore, we can resolve the command line FTP.exe cannot access external
FTP issue by set the ftp mode to PASV. Please type the following command
after you logon the FTP server through command line mode:

quote pasv

This command will make command line ftp works at PASV mode. Then try to
access the FTP site again. How about things?

For the closed source FTP program, you also need to make it works at PASV
mode. Please contact the program developer for help.

Note: Since you had uninstall ISA from SBS, this issue is not relate to ISA
server.

I hope these steps will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| From: thomas.ricky@xxxxxxxxx
| Newsgroups: microsoft.public.windows.server.sbs
| Subject: trouble using ftp.exe to connect to external site
| Date: Fri, 17 Aug 2007 07:49:19 -0700
| Organization: http://groups.google.com
| Lines: 20
| Message-ID: <1187362159.138972.46900@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
| NNTP-Posting-Host: 72.22.154.77
| Mime-Version: 1.0
| Content-Type: text/plain; charset="iso-8859-1"
| X-Trace: posting.google.com 1187362159 21098 127.0.0.1 (17 Aug 2007
14:49:19 GMT)
| X-Complaints-To: groups-abuse@xxxxxxxxxx
| NNTP-Posting-Date: Fri, 17 Aug 2007 14:49:19 +0000 (UTC)
| User-Agent: G2/1.0
| X-HTTP-UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6,gzip(gfe),gzip(gfe)
| Complaints-To: groups-abuse@xxxxxxxxxx
| Injection-Info: 57g2000hsv.googlegroups.com; posting-host=72.22.154.77;
| posting-account=ps2QrAMAAAA6_jCuRt2JEIpn5Otqf_w0
| Path:
TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTFEEDS02.phx.gbl!msrtrans!
msrn-in!newshub.sdsu.edu!postnews.google.com!57g2000hsv.googlegroups.com!not
-for-mail
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:57218
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| I am having difficulty copying data out of my network by ftp when
| using ftp.exe.
| I can contact ftp servers, login, but ftp.exe just hangs when trying
| to get the directory listing.
| This happens on any machine that accesses the internet through the SBS
| server and on the SBS server it self.
| The SBS server is at SP2 and has had ISA installed in the past but it
| was removed.
| I have no problems using internet explorer as an FTP client though.
| I am also having problems with a closed source program that copies
| data out by ftp. This program runs on the SBS server. It does not have
| any options to turn PASV on or off. when copying out data it returns
| an error :
|
| 200 PORT command successful
| 425 could not open data connection to port 34083 connection timed out
|
| could the problem be old rules from the ISA installation or something
| else in the networking stack?
|
|

.

Relevant Pages

  • Re: Hacked? External address knocks on internal private address...
    ... The important part of your message is that FTP is allowed out... ... You open a connection to an FTP Server and logon. ... When you ask the server for a file the server issues a "PORT" command ... so it can open a port on the firewall to allow the incoming Data ...
    (comp.security.firewalls)
  • Re: Question: FTP via alternate port
    ... The problem with FTP is that it requires two ports to operate. ... FTP command stream in order to dynamically open that port for the data ... Ideally the attacker would want to upload another tool onto the ...
    (Pen-Test)
  • Re: IPSwitch, Inc. WS_FTP Server
    ... > bounce attack as well as PASV connection hijacking. ... > The FTP bounce vulnerability allows a remote attacker to cause the ... > anonymously along with any internal addresses that the FTP server has ... That means it's got to handle a PORT ...
    (Bugtraq)
  • Re: Firewalling on FreeBSD
    ... ftp man page, hope it helps - ... the ftp client will send a PASV command for all ... data connections instead of the usual PORT command. ... 00x00 allow tcp from any to any established ...
    (Security-Basics)
  • Re: Internet Explorer Keeps Timing out on FTP
    ... > This is a problem with the FTP client. ... When the PORT command is used, the FTP client is asking the FTP server to ...
    (microsoft.public.inetserver.iis.ftp)