From owner-freebsd-security Sun Jul 5 14:17:41 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id OAA09247 for freebsd-security-outgoing; Sun, 5 Jul 1998 14:17:41 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from implode.root.com (implode.root.com [198.145.90.17]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id OAA09237 for ; Sun, 5 Jul 1998 14:17:37 -0700 (PDT) (envelope-from root@implode.root.com) Received: from implode.root.com (localhost [127.0.0.1]) by implode.root.com (8.8.5/8.8.5) with ESMTP id OAA20990; Sun, 5 Jul 1998 14:17:47 -0700 (PDT) Message-Id: <199807052117.OAA20990@implode.root.com> To: rotel@indigo.ie cc: "Allen Smith" , security@FreeBSD.ORG, njs3@doc.ic.ac.uk, dima@best.net, abc@ralph.ml.org, tqbf@secnet.com Subject: Re: bsd securelevel patch question In-reply-to: Your message of "Sun, 05 Jul 1998 22:03:05 -0000." <199807052103.WAA04673@indigo.ie> From: David Greenman Reply-To: dg@root.com Date: Sun, 05 Jul 1998 14:17:47 -0700 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >On Jul 2, 9:00am, David Greenman wrote: >} Subject: Re: bsd securelevel patch question >> >On Jul 2, 7:10am, David Greenman wrote: >> >> >> >> Well, one thing that is wrong with this is that it is slow. I sure wouldn't >> >> want my busy WWW server doing this for every connection that is made. >> > >> >It would only be necessary to do this for binds to ports < 1024. So it >> >would just be checked every time a daemon started. >> >> Um, well, let's talk about FTP servers, then, since those do a privileged >> bind() for every data connection that is estabilished (one per file transfer). > >This can be solved by using passive mode on the FTP server side, which is >a good idea for security conscious sites anyhow. Passive FTP is initiated by the client and is not something that the server can enforce. Further, it does nothing to enhance security for the server - if anything, it actually reduces the security since you'd have to poke holes through any firewall to allow the client data connects. -DG David Greenman Co-founder/Principal Architect, The FreeBSD Project To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message