Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
org.embulk:embulk-input-ftp
Advanced tools
This plugin support FTP, FTPES(FTPS explicit), FTPS(FTPS implicit) and doesn't support SFTP.
If you want to use SFTP, please use embulk-input-sftp.
embulk-input-ftp v0.2.0+ requires Embulk v0.9.12+
21
. 990
if ssl
is true and ssl_explicit
is false)""
)ssl_trusted_ca_cert_file
but embed the contents of the PEM file as a string value instead of path to a local file (string, optional)FTP and FTPS server usually listens following port number(TCP) as default.
Please be sure to configure firewall rules.
FTP | FTPS(explicit) = FTPES | FTPS(implicit) = FTPS | |
---|---|---|---|
Control channel port | 21 | 21 | 990 (*1) |
Data channel port (*2) | 20 | 20 | 989 |
passive mode
, data channel port can be taken between 1024 and 65535.Simple FTP:
in:
type: ftp
host: ftp.example.net
port: 21
user: anonymous
path_prefix: /ftp/file/path/prefix
FTPS encryption without server certificate verification:
in:
type: ftp
host: ftp.example.net
port: 21
user: anonymous
password: "mypassword"
path_prefix: /ftp/file/path/prefix
ssl: true
ssl_verify: false
FTPS encryption with server certificate verification:
in:
type: ftp
host: ftp.example.net
port: 21
user: anonymous
password: "mypassword"
path_prefix: /ftp/file/path/prefix
ssl: true
ssl_verify: true
ssl_verify_hostname: false # to disable server hostname verification (optional)
# if the server use self-signed certificate, or set path to the pem file (optional)
ssl_trusted_ca_cert_file: /path/to/ca_cert.pem
# or embed contents of the pem file here (optional)
ssl_trusted_ca_cert_data: |
-----BEGIN CERTIFICATE-----
MIIFV...
...
...
-----END CERTIFICATE-----
$ ./gradlew embulk-input-ftp:gem
$ ./gradlew clean embulk-util-ftp:publishMavenPublicationToMavenCentralRepository embulk-input-ftp:gemPush
Firstly install Docker and Docker compose then docker-compose up -d
,
so that an FTP server will be locally launched then you can run tests with ./gradlew test
.
$ docker-compose up -d
Creating network "embulk-input-ftp_default" with the default driver
Creating embulk-input-ftp_server ... done
$ docker-compose ps
Name Command State Ports
---------------------------------------------------------------------------------------------------
embulk-input-ftp_server /start-ftp Up 0.0.0.0:11021->21/tcp, 0.0.0.0:65000->65000/tcp, ...
$ ./gradlew test # -t to watch change of files and rebuild continuously
If you want to use other FTP server to test, configure the following environment variables.
FTP_TEST_HOST (default: localhost)
FTP_TEST_PORT (default: 11021)
FTP_TEST_SSL_PORT (default:990)
FTP_TEST_USER (default: scott)
FTP_TEST_PASSWORD (default: tiger)
FTP_TEST_SSL_TRUSTED_CA_CERT_FILE
FTP_TEST_SSL_TRUSTED_CA_CERT_DATA
If you're using Mac OS X El Capitan and GUI Applications(IDE), like as follows.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>my.startup</string>
<key>ProgramArguments</key>
<array>
<string>sh</string>
<string>-c</string>
<string>
launchctl setenv FTP_TEST_HOST ftp.example.com
launchctl setenv FTP_TEST_USER username
launchctl setenv FTP_TEST_PASSWORD password
launchctl setenv FTP_TEST_SSL_TRUSTED_CA_CERT_FILE /path/to/cert.pem
launchctl setenv FTP_TEST_SSL_TRUSTED_CA_CERT_DATA "-----BEGIN CERTIFICATE-----
ABCDEFG...
EFGHIJKL...
-----END CERTIFICATE-----"
</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
$ launchctl load ~/Library/LaunchAgents/environment.plist
$ launchctl getenv FTP_TEST_HOST //try to get value.
Then start your applications.
FAQs
Unknown package
We found that org.embulk:embulk-input-ftp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.