Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 341)

21-15

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing FTP Inspection

After enabling the strict option on an interface, an ftp command must be acknowledged before a new

command is allowed. Connections sending embedded commands are dropped. The strict option restricts

an FTP server to generating the 227 command and restricts the FTP client to generating the PORT

command. The 227 and PORT commands are further checked to ensure they do not appear in an error

string.

Caution Entering the strict option may break FTP clients that do not comply strictly to the RFC standards.

If the strict option is enabled, each ftp command and response sequence is tracked for the following

anomalous activity:

• Truncated command—Number of commas in the PORT and PASV reply command is checked to see

if it is five. If it is not five, then the PORT command is assumed to be truncated and the TCP

connection is closed.

• Incorrect command—Checks the ftp command to see if it ends with <CR><LF> characters, as

required by the RFC. If it does not, the connection is closed.

• Size of RETR and STOR commands—These are checked against a fixed constant. If the size is

greater, then an error message is logged and the connection is closed.

• Command spoofing—The PORT command should always be sent from the client. The TCP

connection is denied if a PORT command is sent from the server.

• Reply spoofing—PASV reply command (227) should always be sent from the server. The TCP

connection is denied if a PASV reply command is sent from the client. This prevents the security

hole when the user executes “227 xxxxx a1, a2, a3, a4, p1, p2.”

• TCP stream editing.

• Invalid port negotiation—The negotiated dynamic port value is checked to see if it is less than 1024.

As port numbers in the range from 1 to 1024 are reserved for well-known connections, if the

negotiated port falls in this range, then the TCP connection is freed.

• Command pipelining—The number of characters present after the port numbers in the PORT and

PASV reply command is cross checked with a constant value of 8. If it is more than 8, then the TCP

connection is closed.

• The security appliance replaces the FTP server response to the SYST command with a series of Xs.

to prevent the server from revealing its system type to FTP clients. To override this default behavior,

use the no mask-syst-reply command in FTP map configuration mode.

Configuring FTP Inspection

FTP application inspection is enabled default, so you only need to perform the procedures in this section

if you want to change the default FTP configuration, in any of the following ways:

• Enable the strict option.

• Identify specific FTP commands that are not permitted to pass through the security appliance.

• Change the default port number.

1 2 ... 336 337 338 339 340 341 342 343 344 345 346 ... 603 604

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 341