FTP Passive Port Range Standard?

Question

So I know how to set all this up and there are numerous other posts with instructions. However I have a more specific question:

Is there a STANDARD port range to be used for listening for passive FTP server? For example obviously I do not want to do 22-1000 or something. Other than just using a knowledge of what else is running on my machine, how do I determine which ports to use? I have seen on here a suggested range of 5000-5010 for example.

Also bonus question. Is there a recommended NUMBER of ports to open? Filezilla simply offers the entire range from 0 - 65535 with no guidance (Or none I have found) suggesting what range or how many ports to use.

Solution

FTP Protocol Standards

In terms of unauthenticated access being allowed to connect to your FTP server via an open data channel port on the listening FTP server as per the RFC 959:

• server-PI

The server protocol interpreter "listens" on Port L for a connection from a user-PI and establishes a control communication connection. It receives standard FTP commands from the user-PI, sends replies, and governs the server-DTP.

_Source

This means the listening FTP server is expected to follow the standard FTP server protocol so if your FTP server requires authentication then it'll only allow a connection on an opened passive port that it chose to use for the data channel connection after user-PI authentication is established.

• control connection

The communication path between the USER-PI and SERVER-PI for the exchange of commands and replies. This connection follows the Telnet Protocol.

PI

The protocol interpreter. The user and server sides of the protocol have distinct roles implemented in a user-PI and a server-PI.

_Source

---

FTP Security

Using plain FTP for communication and data exchange is insecure since anything that can read the packets can see your data so consider using SSH FTP or FTP SSL to add encryption at this level.

Furthermore as per RFC 959:

• The protocol requires that the control connections be open while data

transfer is in progress. It is the responsibility of the user to request the closing of the control connections when finished using the FTP service, while it is the server who takes the action. The server may abort data transfer if the control connections are closed without command.

_Source

So be sure the FTP server is configured with a short timeout period and this should help get disconnected user sessions and data channel ports closed quicker.

---

Port Security

Consider using a high port range such as 40000-45000 and have your firewall network appliance rules configured to only allow that traffic to go to the FTP server and to put all the packets through a packet scanner for intrusion detection, etc. to thwart common attack patterns and such.

Don't use common ports if possible and look over the List of TCP and UDP port numbers.

Ensure that the FTP server is locked down even further for the ports you allow to be accessible from the Internet with OS level firewall rules, disable unnecessary services, and ensure you do not use ports in the passive range that you use for other services that are listening on this server.

---

FileZilla FTP Server Security

Read the Harden FileZilla FTP Server post and take advantage of these security features.

Comments

[Cade]

The concern I have is if Filezilla doesn't lock these ports, then if some other program begins listening on those ports, I will be opening a security concern.

[Cade]

My concern (Probably a ridiculous one since I manage the server) is that for example if I open didn't know any better and opened ports 3000-4000, then for example I just opened RDP to the world since Filezilla isn't constantly listening on those ports and will not report a problem until it has 3889 more connections outbound. -- Anyway you should post as an answer so I can give you credit.