pfS ftp-proxy binding to 127.0.0.1

[Max Laier]

On Wednesday 22 December 2004 02:55, Didier Wiroth wrote:
> HI,
> I'm still trying openbsd and freebsd.
>
> I'm setting a pppoe router , using pf and ftp-proxy.
> On openbsd you can bind ftp-proxy to the localhost address, openbsd's
> ftp-proxy only listens to 127.0.0.1 like this: 127.0.0.1:8021
>
> On freebsd it listens on all ip addresses, here is the result of sockstat:
> root     inetd      750   4  tcp4   *:8021                *:*
>
>  I do understand that I can explicitly add a pf rule to deny or  allow
> access to the proxy but to enforce security  is it possible to bind
> ftp-proxy so that it only listens to the localhost.

This is not so much a problem with ftp-proxy(8), but with the FreeBSD 
inetd(8). You might want to try ports/security/xinetd instead. It will give 
you a "replacement for inetd with better control and logging" as the port's 
description tells.

-- 
/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20041223/5580b300/attachment.bin