The server then transmits data on this second connection. So, this is more normal. This is better, though it now opens the server up to greater risk. See, now the firewall on the server end has to allow all connections to high ports on the FTP server machines. Well, barring killing off FTP, there is.
Stateful firewalls can watch the data stream and understand the port negotiation.
This is much more necessary when you're using non-stateful firewalls, but is always a good idea. We've also noticed that much of this is aided by good information. You can get more by looking at Kurt Seifried's firewall links page , my upcoming book, or Bob Ziegler's Linux Firewalls book. About the Author Jay Beale is the Security Team Director at MandrakeSoft, makers of Mandrake Linux . He is also the Lead Developer of the Bastille Linux Project , which creates a hardening program to automatically do much of what we talk about here.