
Supported forward proxy method:

  USER user@dest-server[:port]
  PASS pass

Chilkatsoft.com ChilkatFtp2.ProxyMethod = 2

Net::Config:
  ftp_firewall_type 1
    USER user@remote.host[:port]
    PASS pass

Complications:

  '@' symbol in username?
    Avoidable if the USER argument is parsed from end-to-beginning

    What if no '@' symbol appears in USER argument?
    What if single '@' symbol appears in USER argument, as part of actual
      username?

  What if USER is not first command?  I.e. what if we see FEAT, SYST,
    etc?

  What if USER specifies a host that returns 5xx in the banner?  Should
  the client be allowed another USER?  If so, does that count against
  MaxLoginAttempts?

  IPv6 dest server?
    Support "USER user@[::1]:port".  Easy enough.

  FTPS?
    If USER command is received over SSL/TLS, then connection to dest
    server will use SSL/TLS.  Configurable?

      Connect, then send FEAT.  If "AUTH SSL" or "AUTH TLS" appears in
      FEAT, AND mod_proxy+mod_tls is available, then automatically try
      to do FTPS.  No "implicit" FTPS support?

  Connection to dest server opened later

Benefits:

  use mod_proxy in forward mode to add "IPv6" capability, i.e. talk to IPv6
  server, for IPv4-only client.

  use mod_proxy in forward mode to add SSL/TLS capability, i.e. to talk to
  FTPS server, for non-SSL/TLS clients?

Supporting this means not connecting to the real server until pre-USER time;
mod_proxy needs to be modified to deal with this case.  It's work needed
for USER-based backend selection in the reverse proxy case, anyway.

Client configuration:

- proxyuser,user@host
FZ:
  https://www3.trustwave.com/support/kb/article.aspx?id=13497
See WinSCP (https://winscp.net/eng/docs/ui_login_proxy)
this is what lftp calls "user" for its ftp:proxy-auth-type setting.

- proxyuser@host,user
Chrome: uses system proxy settings (on Mac, at least?)
FF:
  http://www.wikihow.com/Enter-Proxy-Settings-in-Firefox
FZ:
  https://www3.trustwave.com/support/kb/article.aspx?id=13497
See WinSCP (https://winscp.net/eng/docs/ui_login_proxy)
this is what lftp calls "proxy-user@host" for its ftp:proxy-auth-type setting.

Future methods:

Net::Config:
  ftp_firewall_type 2
    USER proxy-user
    PASS proxy-pass
    USER user@remote.host[:port]
    PASS pass

  ftp_firewall_type 6
    USER proxy-user@remote.host[:port]
    PASS proxy-pass
    USER user
    PASS pass

See also this, which has *9* methods:
  http://www.mcknight.de/jftpgw/config.html#loginstyle

Limiting the proxied hosts:
  ProxyBlock:
    http://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxyblock

