At 11:44 PM 11/13/02 -0500, you wrote:
I never agreed with it, but one of their reasons to open this was passive FTP. Their reason was a lot of the sites that were visited used Passive FTP, that randomly uses any port above port 1024.
quick reply, hope this hasn't been covered ad naseum...
a solution i have seen used several places is to not allow outbound ftp ( or other restricted services ) from all ip addresses. create seg- ments, or "virtual lan's" for your consultants or other groups who re- quire "privileged" access to the internet. this is one of the ways that "consultants" often cause more harm than they are worth. ( just my opinion, your milege may vary. )
