Windows security question, or general security question

[glennzo]

Here's the deal. Today I installed filezilla server on my wife's XP machine. Then I installed filezilla on my F17 box. When I had trouble logging in from Fedora to her XP box it dawned on me that I probably needed to open port 21 on her computer. I did just that and subsequently was able to connect and view all of her files. Then I started thinking about security and whether I needed to further jiggle the XP firewall to allow only local in-house connections. That thought process pretty much concluded when I realized that as long as port 21 isn't opened in the router I'm fine. Correct assumption?

[trekkie690]

as long as your router firewall doesnt allow connection in on those certain ports, and doesnt have a port forwarding map then ya you should be fine.
Of course i say that and a firewall appliance we have at work said it did this, but then there was a flaw in software which allowed certain MS ports through by default AND DID NOT SHOW THE TRAFFIC!!! which made for fun when we were trying to figure out what all the port 445 and 139 traffic was. Patch fixed it, but as president 40 said, "Trust, but verify"

[Dutchy]

If you're behind a NAT and haven't forwarded any FTP ports you should be fine.
You could install a third party firewall that has the ability to define zones if you really want to be sure.

[Doug G]

The windows firewall that came with XP SP2 has some advanced configuration features if you want to experiment. I have a nagging memory there is a mmc plugin for the advanced firewall settings but I'm not sure about that. netsh cli program has some configuration ability you don't get through the security center firewall plugin.

You can restrict ports to particular subnets. In the windows firewall gui you can edit a port setting then click the change scope button.

http://support.microsoft.com/kb/875357