Date: Sat, 20 Jul 2002 01:35:59 -0400 From: Scott Lambert <lambert@lambertfam.org> To: freebsd-stable@FreeBSD.ORG Subject: Re: Enabling passive FTP on FreeBSD 4.5? Message-ID: <20020720053558.GA3487@laptop.lambertfam.org> In-Reply-To: <20020719122614.O21507@staff.msen.com> References: <p05111b1db95cfe538574@[192.168.254.205]> <016701c22edb$fcc0e250$0600a8c0@P1200n> <3D37A0A7.6070809@quack.kfu.com> <20020719122614.O21507@staff.msen.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Jul 19, 2002 at 12:26:14PM -0400, Michael R. Wayne wrote:
> Having recently fought IPFW on this, and having a hard time finding
> actual firewall rules to make FTP work right on a server that
> provides FTP access to the world, here is what we ended up with
> which appears to properly permit active and passive FTP.
>
> # FTP/ftp
> $fwcmd add 12501 pass tcp from any to ${ip} 20 setup # FTP-data
> $fwcmd add 12505 pass tcp from any to ${ip} 21 setup keep-state
> $fwcmd add 12507 pass tcp from any to ${ip} 49152-65535 setup # Passive FTP
>
> Watching the logs, people are managing to successfully ftp regularly.
>
> Yes, it's a hole. No, we don't like that last rule as someone
> could remotely spawn a shell on one of those ports. But we see no
> way around it as ftp access is a required service for the machine.
Doesn't ipf with ipnat have the ability to watch the FTP control channel
and figure out when and what port to allow through for a passive FTP
data channel? It's been a while since I looked at this so I could be
smoking crack.
--
Scott Lambert KC5MLE Unix SysAdmin
lambert@lambertfam.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020720053558.GA3487>