Re: Hacked

[Bennett Todd <bet () newritz mordor net>]

1995-03-02-15:19:29 Bluefish [@ home]:
> argh. that was a lot of text... What I was wondering is if I somehow could
> firewall tcp21 (FTP port) and still have it (the same application)
> accessable through ssh tunneling somehow?

If you find a way to do the ssh tunneling that works for you (I can't help
with that, haven't tried that myself) then what remains is blocking non-local
access to ftpd. That oughta be easy with ipfw or ipfilter or whatever --- set
up a local kernel packet filter to block remote access to the daemon. This is
also a standard fix when securing bastion hosts for DMZ use, where the syslogd
on the bastion insists on listening to inet ports.

But if you've got ssh all working, isn't scp a lot easier than tunneling ftp?
Or if you want something fancier than scp, why not run rsync over ssh?

OTOH, if you were to want e.g. anon ftp service, I'd probably go with djb's
anonftpd.

-Bennett