I have a passive FTP server setup that accepts ftp-data connections on a specific set of ports, ie 50000-50100
In the /etc/services file, I found the ftp-data entries:
ftp-data 20/tcp # File Transfer [Default Data]
ftp-data 20/udp # File Transfer [Default Data]
ftp-data 20/sctp # FTP
Is it possible to change ftp-data to allow a range of ports instead of an explicit one?
I like doing this because, in my firewall (SuSEFireWall), I can specify port names such as ftp or ftp-data, then the firewall looks in /etc/services to forward/allow those ports. That way, I don't have to enter specific ports in the TCP/UDP boxes.
Looking at this IBM page, it says something about using an _END in the /etc/services file:
The port range must include a start and an END entry. Intermediate entries are optional. Explicitly including intermediate values can be useful for preventing other applications from using these ports
So given that, would it be safe to put:
ftp-data 50000/tcp # File Transfer
ftp-data_END 50100/tcp # File Transfer
serventdata structure cannot return more than one port number. I guess that the IBM application explicitely requests the service names with the suffixes to define port ranges. – Philippe Gauthier Dec 10 '12 at 22:57