From owner-freebsd-questions@FreeBSD.ORG Fri Oct 10 18:11:11 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 017A71065696 for ; Fri, 10 Oct 2008 18:11:11 +0000 (UTC) (envelope-from fbsd06+2S=d302466b@mlists.homeunix.com) Received: from fallback-in1.mxes.net (fallback-out1.mxes.net [216.86.168.190]) by mx1.freebsd.org (Postfix) with ESMTP id CECCC8FC0C for ; Fri, 10 Oct 2008 18:11:10 +0000 (UTC) (envelope-from fbsd06+2S=d302466b@mlists.homeunix.com) Received: from mxout-08.mxes.net (mxout-08.mxes.net [216.86.168.183]) by fallback-in1.mxes.net (Postfix) with ESMTP id D08CD1646FE for ; Fri, 10 Oct 2008 13:54:37 -0400 (EDT) Received: from gumby.homeunix.com. (unknown [87.81.140.128]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.mxes.net (Postfix) with ESMTP id 9F341D05AD for ; Fri, 10 Oct 2008 13:54:35 -0400 (EDT) Date: Fri, 10 Oct 2008 18:54:32 +0100 From: RW To: freebsd-questions@freebsd.org Message-ID: <20081010185432.6eed9643@gumby.homeunix.com.> In-Reply-To: <20081010165116.GA37287@icarus.home.lan> References: <110C2D5E-5772-4304-9F90-FDAC5EACAE2E@identry.com> <20081010165116.GA37287@icarus.home.lan> X-Mailer: Claws Mail 3.5.0 (GTK+ 2.12.11; i386-portbld-freebsd7.0) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Subject: Re: Firewall and FreeBSD ports X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Oct 2008 18:11:11 -0000 On Fri, 10 Oct 2008 09:51:16 -0700 Jeremy Chadwick wrote: > On Fri, Oct 10, 2008 at 12:45:04PM -0400, John Almberg wrote: > > I just set up a new server with a very restricted PF configuration. > > One problem: I can no longer install software with ports (i.e, > > the / usr/ports collection.) I have to disable PF to do so. > > Obviously not a great solution. > > > > Am I correct in guessing that ports uses FTP to grab source files > > from mirrors? I'm trying to figure out the smallest number of ports > > (the TCP/IP kind) that I need to open in my firewall. I don't want > > to enable incoming FTP requests, but do want to allow outgoing ftp > > requests, I believe. > > > > Am I on the right track, here? > > See the fetch(1) man page. Try this first: > > sh/bash: export FTP_PASSIVE_MODE=true > csh: setenv FTP_PASSIVE_MODE true > passive ftp has been the default for long time, fetch is called with the -p option. If you have access to an http-proxy that supports ftp requests over http, fetch can use that. Alternately you can probably avoid ftp altogether by setting: MASTER_SORT_REGEX?= ^http: in make.conf