From owner-freebsd-stable Fri Jul 19 9:26:18 2002 Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6AE8537B400 for ; Fri, 19 Jul 2002 09:26:16 -0700 (PDT) Received: from manor.msen.com (manor.msen.com [148.59.4.66]) by mx1.FreeBSD.org (Postfix) with ESMTP id BEE0443E3B for ; Fri, 19 Jul 2002 09:26:15 -0700 (PDT) (envelope-from wayne@staff.msen.com) Received: (from wayne@localhost) by manor.msen.com (8.9.3/8.9.3) id MAA95592 for freebsd-stable@FreeBSD.ORG; Fri, 19 Jul 2002 12:26:14 -0400 (EDT) (envelope-from wayne) Date: Fri, 19 Jul 2002 12:26:14 -0400 From: "Michael R. Wayne" To: freebsd-stable@FreeBSD.ORG Subject: Re: Enabling passive FTP on FreeBSD 4.5? Message-ID: <20020719122614.O21507@staff.msen.com> References: <016701c22edb$fcc0e250$0600a8c0@P1200n> <3D37A0A7.6070809@quack.kfu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <3D37A0A7.6070809@quack.kfu.com>; from nsayer@quack.kfu.com on Thu, Jul 18, 2002 at 10:16:23PM -0700 Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Having recently fought IPFW on this, and having a hard time finding actual firewall rules to make FTP work right on a server that provides FTP access to the world, here is what we ended up with which appears to properly permit active and passive FTP. # FTP/ftp $fwcmd add 12501 pass tcp from any to ${ip} 20 setup # FTP-data $fwcmd add 12505 pass tcp from any to ${ip} 21 setup keep-state $fwcmd add 12507 pass tcp from any to ${ip} 49152-65535 setup # Passive FTP Watching the logs, people are managing to successfully ftp regularly. Yes, it's a hole. No, we don't like that last rule as someone could remotely spawn a shell on one of those ports. But we see no way around it as ftp access is a required service for the machine. /\/\ \/\/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message