Skip to main content
Wurstsalat
Wurstsalat
Explorer
August 3, 2017
Question

Explicit Proxy + Authentication + FTP/SFTP Connections

  • August 3, 2017
  • 7 replies
  • 21239 views

Hi there,

we want to migrate from MS TMG to FortiGate, at the end FSSO wasnt very reliable in our environment (missing dns records, double homed clients and so on) so we throw away the idea to run the clients without explicit proxy.

 

So on for seamless access we use NTLM on the Proxy Access rules, but when it comes to FTP Clients such as winscp or filezilla they need to authenticate with basic auth at a socks 5 or generic http proxy.

So how could i solve this? Any ideas?

 

 

 

    7 replies

    emnoc
    emnoc
    New Member
    August 3, 2017

    Never did  socks with ftp but have your tried setting up a SOCKS proxy and testing

     

    e.g

     

    curl -v -x socks5h://x.x.x.x:8081  [link]http://www.wwt.com[/link]

     

    x.x.x.x would be your proxy address

     

    cli config

     

    config web-proxy explicit

        set status enable

        set ftp-over-http enable

        set socks enable

        set ftp-incoming-port 2022

        set socks-incoming-port 8081

        set realm "SOCPUPPETS_EXP_PROXY"

        set sec-default-action accept

    end

     

     

    emnoc
    emnoc
    New Member
    August 3, 2017

    Okay I believe you could do this to  check  SOCKS and proxy thru a fortigate, not sure about the authentication.

     

     

     

    GRYHATKEN:~ kfelix$ curl -v --socks4 1.1.1.1:8081  [link]ftp://ftp.fu-berlin.de/pub/atari/linux/[/link]

    *   Trying 1.1.1.1...

    * SOCKS4 communication to ftp.fu-berlin.de:21

    * SOCKS4 connect to 130.133.3.130 (locally resolved)

    * SOCKS4 request granted.

    * Connected to 1.1.1.1 (1.1.1.1) port 8081 (#0)

    < 220 FTP.FU-Berlin.DE ready.

    > USER anonymous

    < 331 Anonymous login ok, send send anything as password.

    > PASS ftp@example.com

    < 230-

    <  Welcome at Freie Universitaet Berlin, Germany.

    <  Willkommen auf dem FTP-Server der Freien Universitaet Berlin.

    <  Ein Service der Zentraleinrichtung fuer Datenverarbeitung (ZEDAT).

    <  

    < 230 FTP.FU-Berlin.DE login ok.

    > PWD

    < 257 "/" is the current directory

    * Entry path is '/'

    > CWD pub

    * ftp_perform ends with SECONDARY: 0

    < 250 CWD command successful

    > CWD atari

    < 550 atari: No such file or directory

    * Server denied you to change to the given directory

    * Connection #0 to host ftp.fu-berlin.de left intact

    curl: (9) Server denied you to change to the given directory

    GRYHATKEN:~ kfelix$ curl -v --socks5 1.1.1.1:8081  [link]ftp://ftp.fu-berlin.de/pub/atari/linux/[/link]

    *   Trying 1.1.1.1...

    * 130

    * 133

    * 3

    * 130

    * Connected to 1.1.1.1 (1.1.1.1) port 8081 (#0)

    < 220 FTP.FU-Berlin.DE ready.

    > USER anonymous

    < 331 Anonymous login ok, send send anything as password.

    > PASS ftp@example.com

    < 230-

    <  Welcome at Freie Universitaet Berlin, Germany.

    <  Willkommen auf dem FTP-Server der Freien Universitaet Berlin.

    <  Ein Service der Zentraleinrichtung fuer Datenverarbeitung (ZEDAT).

    <  

    < 230 FTP.FU-Berlin.DE login ok.

    > PWD

    < 257 "/" is the current directory

    * Entry path is '/'

    > CWD pub

    * ftp_perform ends with SECONDARY: 0

    < 250 CWD command successful

    > CWD atari

    < 550 atari: No such file or directory

    * Server denied you to change to the given directory

    * Connection #0 to host ftp.fu-berlin.de left intact

    curl: (9) Server denied you to change to the given directory

    GRYHATKEN:~ kfelix$

     

     

    I would 1st start by making sure SOCKS v4/5 works NO_AUTHENTICATION and go from that point by enabling Cauthen and identity policies

     

    Mohammand,

     

    if your following this post, I will PM you something as soon as  I land.

     

    Enjoy 

     

    :)

     

    Wurstsalat
    WurstsalatAuthor
    Explorer
    August 3, 2017

    thanks for your suggestion, i thought about enabling socks but i read previously about it and it didnt read as a good solution

     

    I tried it and what i see....is not really good

    - as soon as any Client is able to connect to the socks Proxy, it is completetly unrestricted (no filter works, even not antivirus) and no authentication happens nor is it possible...if you send a username it doesnt care. I read about this behaviour before in this forum i think

     

    Connection through socks is possible, so it is through generic proxy (HTTP) without authentication

     

    At the moment

    - Enabling SOCKS creates a whole Bypass of any rules

    - Using generic Proxy/HTTP authentication cant be used

     

    Stuck at the moment :(

     

     

    edit

    btw i am currently on 5.4, socks5 auth is only support uppon 5.6

    http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-whats-new/Top-Firewall-Transparent-proxy.htm

    So on 5.4 i cant use socks5 at the moment

    Any ideas for http proxy to allow ntlm+basic auth?

     

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!