View Single Post
Old 11-27-2010, 04:16 PM  
Too much time...
Join Date: May 2005
Posts: 1,194

At the moment the Changelog is probably the best place to look for details. Here's a bit from the 7.5.0 release notes:

6) The default settings for the new safety feature preventing the PORT
   command from accessing private/local LAN IP addresses means you will need
   to use PASV connections for local transfers using a FTP client on the LAN.
   This is usually the default method so you probably won't notice.  However
   FXPing between 2 FTP servers across the local LAN (i.e. both 192.168.*)
   will no longer work with the default settings.  The server will also not
   be able to FXP to itself (although if people want this I can probably
   find a way to allow it).  To enable FXP between two local machines you
   can choose to either disable the new feature on one site, or you can
   just define a second Service that is only accessible to machines on the
   local LAN that has the feature disabled.  The second Service method is
   HIGHLY recommended because you can also do things like relax the encrypted
   data transfer requirement which will improve local transfer speeds.

9) New ioFTPD.ini option (Deny_Port_Host_<num> under [FTP_Service]).  Active
   mode data transfers require the server to create connections to a user
   specified IP/Port.  For security reasons the server should be prevented
   from initiating connections to the server box or any other machine behind
   your firewall if you have one.  By default the server will now block
   access to the following non-routable private IP ranges: 10.*, 172.16.*,
   192.168.*, and the loopback interface 127.*.  To disable this feature
   entirely just specify as the host to block.  Alternatively, you
   may specify your own custom list of IP addresses/ranges to block.
I obviously like the 2nd service method as it's more flexible and you don't give up any safety. Basically you do something like this. Copy the [FTP_Service] section in the .ini file and rename the copy as [Local_Service] or whatever you want. Disable the Deny_Port_Host feature and, if set, the encrypted transfer requirements, and change the PORT to an IP that isn't forwarded in the router. Add the new service to the list of services to start automatically via
Active_Services = FTP_Service Local_Service

Then locally connect to the new service/port instead of the other one and you should be good to go.
Yil is offline   Reply With Quote