Date: Fri, 4 Aug 1995 06:10:37 -0700 From: Paul Traina <pst> To: security Subject: FTP data port restrictions Message-ID: <199508041310.GAA10264@freefall.cdrom.com>
next in thread | raw e-mail | index | archive | help
While looking at Nick Sayer's home page, I caught his reference to FTP data port quarantines, and after thinking about it a bit, decided that this is a good idea, and by default, FreeBSD's FTP client and daemon programs should try to always use a restricted range of data ports (40000-44999) for transfers. If you have a FTP server, you would like your FTP server to restrict its port range to a safe area when clients ask for a passive FTP connection, so you don't have to expose all of your >1023 ports on this machine. If you have a FTP client, you would like to be able to restrict the ports you request to a given "safe" range in case you're talking to some mean old nasty FTP server that doesn't support passive mode (because THEIR sysadmins are as paranoid as OUR sysadmins). The basic idea here is that we leave 40000-44999 open, since no known sane services reside there (yeah, sure...) at the firewalls, and can therefore button down everything else. This in no way precludes passive mode transfers, rather it extends the usablity of FTP clients and FTP servers in light of passive and non-passive mode transfers. Would someone care to check over my diffs for any glaring errors? They're freefall: ~pst/ftp-diffs Still TODO: ncftp version and documentation
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199508041310.GAA10264>