From owner-freebsd-pf@FreeBSD.ORG Thu Dec 23 11:31:46 2004 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5CDD616A4CE for ; Thu, 23 Dec 2004 11:31:46 +0000 (GMT) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.171]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1109C43D39 for ; Thu, 23 Dec 2004 11:31:46 +0000 (GMT) (envelope-from max@love2party.net) Received: from [212.227.126.206] (helo=mrelayng.kundenserver.de) by moutng.kundenserver.de with esmtp (Exim 3.35 #1) id 1ChRC5-0005yc-00; Thu, 23 Dec 2004 12:31:45 +0100 Received: from [217.83.15.89] (helo=donor.laier.local) by mrelayng.kundenserver.de with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1ChRC4-0007PY-00; Thu, 23 Dec 2004 12:31:44 +0100 From: Max Laier To: freebsd-pf@freebsd.org Date: Thu, 23 Dec 2004 12:31:41 +0100 User-Agent: KMail/1.7.1 References: <8e3f9722ef1.41c8e20b@etat.lu> In-Reply-To: <8e3f9722ef1.41c8e20b@etat.lu> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart1269397.G8jI1nBnKt"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200412231231.42864.max@love2party.net> X-Provags-ID: kundenserver.de abuse@kundenserver.de auth:61c499deaeeba3ba5be80f48ecc83056 Subject: Re: pfS ftp-proxy binding to 127.0.0.1 X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical discussion and general questions about packet filter (pf) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Dec 2004 11:31:46 -0000 --nextPart1269397.G8jI1nBnKt Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Wednesday 22 December 2004 02:55, Didier Wiroth wrote: > HI, > I'm still trying openbsd and freebsd. > > I'm setting a pppoe router , using pf and ftp-proxy. > On openbsd you can bind ftp-proxy to the localhost address, openbsd's > ftp-proxy only listens to 127.0.0.1 like this: 127.0.0.1:8021 > > On freebsd it listens on all ip addresses, here is the result of sockstat: > root inetd 750 4 tcp4 *:8021 *:* > > I do understand that I can explicitly add a pf rule to deny or allow > access to the proxy but to enforce security is it possible to bind > ftp-proxy so that it only listens to the localhost. This is not so much a problem with ftp-proxy(8), but with the FreeBSD=20 inetd(8). You might want to try ports/security/xinetd instead. It will give= =20 you a "replacement for inetd with better control and logging" as the port's= =20 description tells. =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --nextPart1269397.G8jI1nBnKt Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (FreeBSD) iD8DBQBByqyeXyyEoT62BG0RApJGAJ9yBKTN4y934J0/DVIgNw0ar2e8owCggL4k Ps0BnTc0aHiMhdd6XQUYanE= =AB3c -----END PGP SIGNATURE----- --nextPart1269397.G8jI1nBnKt--