Subject: Re: idle ports

From: Joseph S D Yao <[email-masked]>
Date: Wed, 8 Mar 2000 13:36:38 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

On Thu, Feb 17, 2000 at 06:53:14PM -0500, Ted Keller wrote:
> [To be removed from this list send the message "unsubscribe fwtk-users" in the
> BODY of a mail message to [email-masked].]
> 
> Blair,
> 
> Idle ports should be closed when the proxy exits. This normally occurs
> when the timeout values have been reached.
> 
> ted keller

[Catching up on old unread e-mail.]

Clarification, just because I find the original question ambiguous:

The system on which FWTK is running should originally be configured so
as not to open any ports on which proxies are not running.  Thus there
are no "idle" ports in that sense.  [If you use ipchains or socks or
something else that puts holes in the bastion host, that's your worry.]

The 'inetd' or proxy daemon will keep open ports on which incoming
services are to be run, and pass off requests to separate processes for
each request, each of which is reading its own socket port.  The open
ports may be viewed as "idle", but they are necessary.

If the port of a running proxy becomes idle, the action depends on the
individual proxy.  Most proxies that come with the original proxy seem
to have timeouts set.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.