Bugtraq: Re: ftpd: the advisory version

[djb () CR YP TO (D. J. Bernstein)]

monti writes:
> *allowing* other than src-20 active data connections through a firewall,
Why are you allowing PORT-style FTP through your firewall? See RFC 1579.
Can I scan port 6000 on your hosts if I set my source port to 20?

Netscape uses PASV. The OpenBSD ftp client uses PASV. The Linux ftp
client uses PASV if you give it the -p option. Internet Explorer uses
PASV. What makes you think that requiring PASV will noticeably increase
the level of user annoyance at your firewall?

---Dan