Re: pf and passive (ftp) port tricks

2006-03-29 Thread Tobias Ulmer
On Wed, Mar 29, 2006 at 12:08:04PM +0200, Michael Schmidt wrote: > David Elze wrote: > > >Well, I needed the exact same thing and did it with pure-ftpd[1] via the > >command-line option "-p 5:50400" and an pf.conf entry like "pass in > >on $if tcp from any to $if port 5:50400". Maybe this

Re: pf and passive (ftp) port tricks

2006-03-29 Thread Michael Schmidt
David Elze wrote: Well, I needed the exact same thing and did it with pure-ftpd[1] via the command-line option "-p 5:50400" and an pf.conf entry like "pass in on $if tcp from any to $if port 5:50400". Maybe this is an option for you too. Hello, thanks for your feedback, David. And

Re: pf and passive (ftp) port tricks

2006-03-28 Thread Per-Olov Sjöholm
On Tuesday 28 March 2006 14.09, Michael Schmidt wrote: > Hello, > > did anyone setup helpful tricks in pf concerning passive ports for ftp? > > Why I am asking has the following reason: > In general you have to open ports for incoming passive ftp requests on a > wide range, but that4s a point I don

Re: pf and passive (ftp) port tricks

2006-03-28 Thread David Elze
Am Dienstag, den 28.03.2006, 14:09 +0200 schrieb Michael Schmidt: Hi, > So what I want to setup is pf and the ftp-daemon in that way that the > ftp-daemon offers only a very small range of passive ports (or perhaps > only one single passive port?) and that pf opens only the same small > range of

Re: pf and passive (ftp) port tricks

2006-03-28 Thread Michael Schmidt
Michael Schmidt wrote: Hello, did anyone setup helpful tricks in pf concerning passive ports for ftp? Why I am asking has the following reason: In general you have to open ports for incoming passive ftp requests on a wide range, but that4s a point I don4t like as I want to make life as hard

pf and passive (ftp) port tricks

2006-03-28 Thread Michael Schmidt
Hello, did anyone setup helpful tricks in pf concerning passive ports for ftp? Why I am asking has the following reason: In general you have to open ports for incoming passive ftp requests on a wide range, but that4s a point I don4t like as I want to make life as hard as possible for intruders