Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 21 Feb 2003 18:02:12 -0500
From:      Garance A Drosihn <drosih@rpi.edu>
To:        "Jeroen C. van Gelderen" <jeroen@vangelderen.org>, Robert Watson <rwatson@FreeBSD.org>
Cc:        "Crist J. Clark" <cjc@FreeBSD.org>, src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org
Subject:   Re: cvs commit: src/sys/netinet in_pcb.c (priv ports)
Message-ID:  <p05200f18ba7c5e8a0f1b@[128.113.24.47]>
In-Reply-To: <4B77CF28-45C2-11D7-9535-000393754B1C@vangelderen.org>
References:  <4B77CF28-45C2-11D7-9535-000393754B1C@vangelderen.org>

next in thread | previous in thread | raw e-mail | index | archive | help
At 6:31 PM +0100 2/21/03, Jeroen C. van Gelderen wrote:
>
>In the meantime however, allowing an extension of the original,
>overly restrictive feature provides some relief.

I do think the change as done is a fine change.  I would not even
suggest that it be labelled "experimental".

>For a large class of well-designed network protocols (including
>SSH) the associated risk is limited to mere Denial of Service;
>Annoying but preferred over a potential root compromise.

The one thing we need to make clear is that the admin is not
opening up "just SSH -- which we can trust", they are going to
open up a range of ports.  I think it's good to give them a way
to do that, as long as it is clearly documented what they are
doing.  We should not say "just type in this command to open up
FTP!", when the command is opening up more than FTP.

However, I have a vague feeling that I am not understanding this
update quite right, as I certainly have been confused by some of
the replies in this thread.  I should look at it more before I
say something profoundly stupid about it.

>And given that they are optional *and* disabled by default, the
>new sysctls fit the FreeBSD mantra of "providing tools, not policy".

I do think it's a useful change.  It's just not useful-enough that
I (personally) would use it, even though I would take advantage of
something a little more flexible.  I do understand that "more
flexible" implies "more work" though.

-- 
Garance Alistair Drosehn            =   gad@gilead.netel.rpi.edu
Senior Systems Programmer           or  gad@freebsd.org
Rensselaer Polytechnic Institute    or  drosih@rpi.edu

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?p05200f18ba7c5e8a0f1b>