Date: Fri, 19 Jul 2002 12:26:14 -0400 From: "Michael R. Wayne" <wayne@staff.msen.com> To: freebsd-stable@FreeBSD.ORG Subject: Re: Enabling passive FTP on FreeBSD 4.5? Message-ID: <20020719122614.O21507@staff.msen.com> In-Reply-To: <3D37A0A7.6070809@quack.kfu.com>; from nsayer@quack.kfu.com on Thu, Jul 18, 2002 at 10:16:23PM -0700 References: <p05111b1db95cfe538574@[192.168.254.205]> <016701c22edb$fcc0e250$0600a8c0@P1200n> <3D37A0A7.6070809@quack.kfu.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Having recently fought IPFW on this, and having a hard time finding
actual firewall rules to make FTP work right on a server that
provides FTP access to the world, here is what we ended up with
which appears to properly permit active and passive FTP.
# FTP/ftp
$fwcmd add 12501 pass tcp from any to ${ip} 20 setup # FTP-data
$fwcmd add 12505 pass tcp from any to ${ip} 21 setup keep-state
$fwcmd add 12507 pass tcp from any to ${ip} 49152-65535 setup # Passive FTP
Watching the logs, people are managing to successfully ftp regularly.
Yes, it's a hole. No, we don't like that last rule as someone
could remotely spawn a shell on one of those ports. But we see no
way around it as ftp access is a required service for the machine.
/\/\ \/\/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020719122614.O21507>