Subject: reverse proxying with ftp-gw

From: "Dima Golubev" <[email-masked]>
Date: Thu, 27 Apr 2000 14:23:15 +0000 (GMT)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

hi folks,

I`m using ip filter and installed ftp-gw with appropriate
patches in hopes of gaining more security for my servers
doing ftp.

Well, now I don`t need to open up even relatively small 
port ranges of several thousands ports for them and easily
have centralised logging/blocking of ftp commands.

OTOH I understand that ftp-gw was not designed for this
kind of usage and so can have flaws from this POV.
One of them is obvious to me - a yahoo can connect to 
ftp-gw directly and then jump to any ftp capable host inside
my internal network. I deal with it passing ftp connections
from my ip filter box only to the restricted number of ftp
servers ("-dest" ftp-gw option doesn`t seem to work - "SIOCGNATL
failed - No such process").

My questions follow:

What do you think of this setup? Didn`t I lose security somewhere?

Can ftp-gw be used for at least primitive ftp daemons exploitation protection?
If yes are any modifications required?

Your opinions are very appreciated.

--
Dima
______________________________________________________________
iName - your free web-based mail service (http://www.iname.ru)