At 05:19 PM 12/12/2003, Barney Wolff wrote: >For most systems, the coarse granularity of sysctl net.inet.ip.portrange >would seem sufficient.
This brings up an interesting point. I just typed sysctl -a | grep portrange into a recently minted 4.9 box, and got: net.inet.ip.portrange.lowfirst: 1023 net.inet.ip.portrange.lowlast: 600 net.inet.ip.portrange.first: 1024 net.inet.ip.portrange.last: 5000 net.inet.ip.portrange.hifirst: 49152 net.inet.ip.portrange.hilast: 65535 Why is "lowfirst" greater than "lowlast" above? It is also interesting that natd doesn't respect the "hifirst..hilast" settings here. Shouldn't it look at these variables and avoid assigning ports that the machine on which it's running would not use? Or should there be a "net.inet.alias.portrange.first", etc., so that one could specify the ranges or lists for everything in one place? >I have a real philosophical problem with ceding ports to worms, viruses >and trojans. Where will it stop? Portno is a finite resource. In theory, it stops when all Windows users have patched their machines. Alas, this will happen when a very warm place freezes over. :-( In practice, I think we need to come up with something better than the notions of "well-known" and "privileged" ports. Something that, unlike portmap, is easy for firewalls to work with. --Brett _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
