Any danger from these ports?

[Alexander Dalloz]

Am Do, den 13.01.2005 schrieb Charles R. Anderson um 4:47:

> > It is much better to use ip_conntrack_ftp iptables helper module and the
> > stateful capabilities of iptables (ESTABLISHED,RELATED) rather than to
> > "blindly" open a range of high ports. Why using ipchains, which is not
> > stateful, when having iptables?
> 
> Because the box is a RHL 7.3 box and I was only familiar with ipchains
> at the time.  Because non-stateful firewalls by their very nature
> operate in a simpler manner that is less likely to break.  Because I
> know nothing besides FTP is using the passive port range I chose. 
> Note that I did qualify my statements with "If you are not using a
> stateful firewall with a FTP helper"...

I see.

> If I was going to set this up again today, I would probably use what
> you suggest.

Ok :) I should have made myself clearer. I was just arguing that
iptables is to be preferred - I recognized your "if clause". Why poking
a hole into the "firewall" if you don't have to? I see the background of
your description (RH7.3 and ipchains trained). Take my reply as an add
to your passive FTP packet filtering description - just matching
iptables on current Fedora Core systems.

Regards

Alexander
 

-- 
Alexander Dalloz | Enger, Germany | new address - new key: 0xB366A773
legal statement: http://www.uni-x.org/legal.html
Fedora GNU/Linux Core 2 (Tettnang) on Athlon kernel 2.6.10-1.8_FC2smp 
Serendipity 13:57:37 up 2 days, 12:08, load average: 0.41, 0.54, 0.41 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Dies ist ein digital signierter Nachrichtenteil
Url : http://lists.fedoraproject.org/pipermail/test/attachments/20050113/cf42ce5b/attachment.bin