不需要inetd的FTP-proxy

zhaohaha

ftp-proxy, new style

For OpenBSD 3.9 and newer
If you are upgrading to OpenBSD 3.9 or working from a fresh 3.9 or newer install,
this is the ftp-proxy version to use.

Just like its predecessor, the pftpx successor ftp-proxy configuration is
mainly a matter of cut and paste from the man page.
If you are upgrading to the new ftp-proxy from an earlier version, you need
remove the ftp-proxy line from your inetd.conf file and restart inetd.
Next, enable ftp-proxy by adding the following line to your
/etc/rc.conf.local or /etc/rc.conf
ftpproxy_flags=""
You can start the proxy manually by running /usr/sbin/ftp-proxy if
you like.
Moving on to the pf.conf file, you need two anchor definitions in the NAT
section:
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
Both are needed, even if your setup does not use NAT. If you are migrating
from a previous version, your rule set probably contains the appropriate
redirection already. If not, you add it:
rdr pass on $int_if proto tcp from any to any port ftp -> 127.0.0.1 \
port 8021
Moving on down to the filtering rules, you add an anchor for the proxy to fill
in,
anchor "ftp-proxy/*"
and finally a pass rule to let the packets pass from the proxy to the rest of
the world
pass out proto tcp from $proxy to any port 21 keep state
where $proxy expands to the address the proxy daemon is bound to.
This example covers the simple setup with clients who need to contact FTP
servers elsewhere. For other variations and more complicated setups, see
the ftp-proxy man page.
If you are looking for ways to run an FTP server protected by PF and
ftp-proxy, you could look into running a separate ftp-proxy in reverse mode
(using the -R option).

zhaohaha

占用