From owner-freebsd-questions@FreeBSD.ORG  Tue Jun 17 07:08:49 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 17ADF37B401
	for <freebsd-questions@freebsd.org>;
	Tue, 17 Jun 2003 07:08:49 -0700 (PDT)
Received: from kanga.honeypot.net (kanga.honeypot.net [208.162.254.122])
	by mx1.FreeBSD.org (Postfix) with ESMTP id D4DEB43F85
	for <freebsd-questions@freebsd.org>;
	Tue, 17 Jun 2003 07:08:47 -0700 (PDT)
	(envelope-from kirk@strauser.com)
Received: from pooh.honeypot.net.strauser.com (kirk@pooh.honeypot.net
	[10.0.5.128])
	by kanga.honeypot.net (8.12.9/8.12.9) with ESMTP id h5HE8kZY077958
	for <freebsd-questions@freebsd.org>;
	Tue, 17 Jun 2003 09:08:46 -0500 (CDT)
	(envelope-from kirk@strauser.com)
To: freebsd-questions@freebsd.org
References: <20030617121346.GA80594@athomson.prv.au.itouchnet.net>
From: Kirk Strauser <kirk@strauser.com>
Date: Tue, 17 Jun 2003 09:08:42 -0500
In-Reply-To: <20030617121346.GA80594@athomson.prv.au.itouchnet.net> (Andrew
 Thomson's message of "Tue, 17 Jun 2003 22:13:46 +1000")
Message-ID: <87smq8lrth.fsf@pooh.honeypot.net>
Lines: 15
X-Mailer: Gnus/5.1002 (Gnus v5.10.2) Emacs/21.3 (gnu/linux)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha1; protocol="application/pgp-signature"
Subject: Re: restrictive ipfw ruleset and ftp
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Jun 2003 14:08:49 -0000

--=-=-=
Content-Transfer-Encoding: quoted-printable

At 2003-06-17T12:13:46Z, Andrew Thomson <ajthomson@optushome.com.au> writes:

> i have a list of ports that i let my users go out on: 80, 22, 143, 443 etc
> etc..

Out of curiosity, do you have control over the set of machines that your
users are connecting to?  I.e., are they uploading to your own FTP server at
a colo site?  If so, you might consider dropping FTP altogether in favor of
SFTP.  It's radically easier to firewall; you just open a single TCP port.
You also get decent authentication and end-to-end encryption.  Just a
thought.
=2D-=20
Kirk Strauser
In Googlis non est, ergo non est.

--=-=-=
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQA+7yDt5sRg+Y0CpvERAtf9AKCDG8iZc2sHvDuHHAOz1PdwdZ5AdQCfZSCm
YIGPaGd8A9NkoHgNWORqhaI=
=Yp4x
-----END PGP SIGNATURE-----
--=-=-=--