Re: active ftp through firewall
From: Barry Margolin (barmar_at_alum.mit.edu)
Date: 05/26/04
- Previous message: phn_at_icke-reklam.ipsec.nu: "Re: active ftp through firewall"
- In reply to: jpd: "Re: active ftp through firewall"
- Next in thread: phn_at_icke-reklam.ipsec.nu: "Re: active ftp through firewall"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 26 May 2004 12:31:31 -0400
In article <1085579857.16076@ente.ipberlin.com>,
jpd <read_the_sig@do.not.spam.it> wrote:
> On 2004-05-20, Barry Margolin <barmar@alum.mit.edu> wrote:
> > In article <1085036311.748582@ente.ipberlin.com>,
> > jpd <read_the_sig@do.not.spam.it> wrote:
> >
> >> ["Followup-To:" header set to comp.security.unix.]
> >> On 2004-05-20, Barry Margolin <barmar@alum.mit.edu> wrote:
> >> > Firewalls are supposed to watch the traffic on the FTP command channel,
> >> > and notice when a PORT command goes through so that they can open up
> >> > that port for an inbound connection from the FTP server.
> >>
> >> And why do you suppose them to do so?
> >
> > Because it's important to support a heavily-used Internet application
> > protocol.
>
> It may be important to you, but that does not excuse assumption without
> checking. If you want your firewall to support protocol inspection (for
> _any_ protocol, no matter how heavily it is used) you'd better make
> sure your desired hardware or software supports that.
That implies that people who purchase firewalls are knowledgeable enough
about protocols that they know that this is something to look for. I
expect that 99% of Internet users would have no idea that this is a
desirable feature. And even if they did, how would they know whether a
particular firewall had it? It's not something that's advertised on the
box.
> What I'm saying is that you shouldn't simply suppose things but rather
> explicitly ask for features you want. You ASS-U-MEd, as certain people
> say, based upon personal preferences and I think that bad practice.
Perhaps "supposed" was a poor word -- I *expect* a full-featured
firewall to support FTP. Full-featured firewalls have been doing this
for years. Only a simple port filter has any excuse not to.
-- Barry Margolin, barmar@alum.mit.edu Arlington, MA *** PLEASE post questions in newsgroups, not directly to me ***
- Previous message: phn_at_icke-reklam.ipsec.nu: "Re: active ftp through firewall"
- In reply to: jpd: "Re: active ftp through firewall"
- Next in thread: phn_at_icke-reklam.ipsec.nu: "Re: active ftp through firewall"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
