Re: FTP outbound

[Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>]

Not just "roll your own"!  The exit point only applies to IBM's FTP 
client included with the operating system.  Any other FTP client you use 
(including high-quality, mature, commercially developed ones) will 
bypass the exit point.

Securing the *CMD object is at least as effective as using an exit 
program for what you're doing.  And it's much simpler to do.

Now if you wanted to allow some requests (but not all) then the exit 
point would be more appropriate.

But bear in mind that either restricting the *cmd object, or writing an 
exit program is only security one particular piece of software (IBM's 
FTP client) it's not stopping FTP in the general sense.

If you really want to stop FTP in the general sense, block outbound 
connections on port 21.


rob@xxxxxxxxx wrote:
> Easy, and effectively, are two different things.
> Are you concerned about also shutting down roll your own FTP socket 
> programs and that genre (as published by Scott Klement)?  Then securing 
> FTP or STRTCPFTP won't work.  I am not so sure that the roll your own even 
> goes through the exit point programs.  But I am assuming not.  If you want 
> to get that protective you'll have to look at packet filtering, etc.
>
> Rob Berendt