Groups | Blog | Home
all groups > iis security > july 2003 >

iis security : FTP and passive FTP port ranges


Steve
7/28/2003 10:42:13 AM
Is it possible, via some registry key or something, to
give IIS a range of assignable ports when the FTP client
sets the FTP session to be passive.

I'd setting up some stateless packet filters for a server
and would prefer to not allow incoming connections from
the entire unassigned port range x > 1024 for this server.

Maybe IIS only uses a specific port range by default
anyway?

Thanks for any help on this. I searched the web and
technet for related information but have come up empty so
far.

Thanks,
Keith W. McCammon
7/28/2003 3:54:07 PM
[quoted text, click to view]

By default, I believe that Windows 2000 can use ports 1024-5000 ephemerally.
I know for a fact that this can be changed. However, it is an IP-related
setting, and is not FTP specific.

The details are available in the Windows 2000 TCP/IP implementation white
papers:

http://www.microsoft.com/windows2000/docs/tcpip2000.doc


Bernard
7/29/2003 11:12:13 AM
You can customize this port ranges in IIS 6.0.
but not with IIS 5.0 and below. refer this kb.

Information About the IIS File Transmission Protocol (FTP) Service
http://support.microsoft.com/?id=283679


--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...


[quoted text, click to view]

Steve
7/29/2003 11:16:09 AM
Thanks Bernard.

Do you know if IIS 5.0 uses a specific port range or
*must* I open all inbound connections between 1024 > 65535?

In a little testing between two different IIS FTP servers,
I'm only seeing the assigned port ranges for passive
connections between 1024 > x < 5000.

Steve
[quoted text, click to view]
Bernard
7/30/2003 12:17:59 PM
Something like that :(

Well, I remembered I once play with checkpoint firewall one
before, kinda smart. default it only use active mode for
connection.. after that if it's a 'valid' ftp session, the firewall
will allow opening of passive mode ports to that server from
this particular clients for this particular session.

so default only open ftp service with 21,20. and it's smart
enough to cater passive mode, if you enable it in the
firewall settings.

I'm not sure if this feature is available for other devices.

You should try open from 1024 - 5000

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...


[quoted text, click to view]

AddThis Social Bookmark Button