Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So there's a bunch of questions for enabling Passive, differences between Active/Passive etc.

I would like to know, is it a bad idea to enable Passive? If I understand correctly... it requires opening up a port range, which sounds like a bad idea to me. Thoughts?

share|improve this question
1  
Do you want FTP to actually work? –  Michael Hampton May 16 '13 at 16:08
    
FTP works perfectly fine with Active. Doesn't work with Passive... –  Phill May 16 '13 at 16:10
    
It's a bad idea to use FTP in general when there are so many other superior methods of file transfer. –  kce May 16 '13 at 16:11
    
@kce I would disable it but client wants it to be able to bulk upload images to their site. Now-n-then they whinge at me because "ftp doesn't work" and I have to get them to change filezila to use active mode. Since it doesn't do it by default or something, and I don't want to open up a port range for them. –  Phill May 16 '13 at 16:14
    
Something is wrong with your setup. It's usually active mode that has the issues (due to the way NAT firewalls work). –  Matt May 22 '13 at 21:11
add comment

2 Answers

up vote 5 down vote accepted

It depends what your aim in running an ftp server is. If you want to keep it secure, it's a bad idea. If you want people to get files from it, it's a good idea, because very few client networks will allow active-mode ftp any more; it doesn't play well with NAT, and it requires them either to open up arbitrary port ranges, or have an adaptive firewall.

Basically, ftp has rather had its day, as a transfer protocol. If you're going to insist on using it (as opposed to, say, sftp) then put it on a disposable machine on a DMZ well walled-off from the core network; and if you have a good adaptive firewall, that can help mitigate the risk of leaving that port range open.

share|improve this answer
    
There's nothing wrong security wise with setting aside a few ports for ftp. –  psusi May 16 '13 at 18:09
    
@psusi The firewall is not the issue: FTP sends passwords in clear text over the internet. It is just as bad as telnet. (In fact the FTP command channel is actually telnet.) And as many users can't be bothered to use different accounts/passwords for various services they are using... Anybody with only a grain of common sense will refuse to use FTP altogether. –  Tonny May 16 '13 at 18:22
    
@Tonny, that's true wither you are using passive or not. MadHatter seems to be saying that opening a few ports for passive is, in itself, bad. There's nothing wrong with opening a few ports for a passive ftp server that only allows anonymous logons. –  psusi May 16 '13 at 19:39
    
psusi, if you thought I said that, I have been unclear. I said only that a passive ftp server with no open ports is more secure, but less useful, than a passive ftp server with some open ports. I tried also to say that there are better secure-vs-useful tradeoffs available, such as an ftp server with some passive ports open behind an adaptive firewall, or an sftp server that encrypts both authentication data and content, and runs on a single port. –  MadHatter May 16 '13 at 20:02
    
In the end I just sent my client a small PDF on how to setup their FileZilla properly to use Active for my server. And setup a user with 0 permissions other than to access a single images folder so they can upload the stuff they need. No more issues :) Wish I could avoid FTP all together but sometimes can't be helped. –  Phill May 23 '13 at 1:24
add comment

Passive FTP ports are not bad.

First of all FTP Passive Ports are transient. Meaning that there should be nothing on these port unless there is an active transfer.

Second, most FTP Servers allow you to specify a passive port range. So instead of opening up 1000 ports (so you could do 1000 concurrent transfers) you could open 20 ports (or even less if your concurrent number of users is small) to allow fewer concurrent transfers. I have seen FTP Servers running with only 5 passive ports opened.

Third, you can install SSL and run your server in an implicit FTPS mode, most FTP clients support FTPS. This is by far the best thing you could do, the issue of passive ports is probably less relevant then securing the FTP connections.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.