[squid-users] RV: squid

[Alex Rousskov]

On 06/15/2017 09:55 AM, Matus UHLAR - fantomas wrote:
>> ftp://ftp.fu-berlin.de/unix/www/squid/archive/3.5/squid-3.5.0.1-RELEASENOTES.html
>> " Active and passive FTP support on the user-facing side; require passive
>> connections to come from the control connection source IP address."

> that means, if you open FTP control connection to squid, the passive data
> connection to it must come from the same IP as control connection.

IIRC, the above interpretation is the right one:

* We support both active and passive FTP between an FTP client (a.k.a.
user) and Squid.

* When an FTP client is using passive mode, the data connection must
come from the same IP as the control connection. This restriction blocks
attacks that steal data connection of legitimate FTP users.

AFAIK, there are currently no plans (or even strong demand) to support
active FTP mode between Squid and FTP origin servers.


Alex.