[ On Sunday, August 11, 2002 at 13:57:56 (-0500), Joe Reed wrote: ]
> Subject: Re: new sysctl - privilaged ports runtime option?
>
> what you can do though is remove the restriction on the ports, then use 
> systrace to restrict them.  this gives you the ablility to have sendmail, 
> etc. running as an unpriv user, but still allowed to bind to the proper 
> port(s).

I generally _really_ like to do security related things in exactly the
opposite way so that they "fail safely".  I.e. only release the
restrictions on specific ports, and to only do that via a restricted
interface.  Assuming it works then IPNAT satisfies my requirements
exactly, whereas using NOPRIVEPORTS+systrace goes diametrically opposite
to them.

(please respond only to the list, as per my reply-to: header, and feel
free to ask me to do the same)

-- 
								Greg A. Woods

+1 416 218-0098;            <g.a.woods@ieee.org>;           <woods@robohack.ca>
Planix, Inc. <woods@planix.com>; VE3TCP; Secrets of the Weird <woods@weird.com>