So there's a bunch of questions for enabling Passive, differences between Active/Passive etc.
I would like to know, is it a bad idea to enable Passive? If I understand correctly... it requires opening up a port range, which sounds like a bad idea to me. Thoughts?
It depends what your aim in running an ftp server is. If you want to keep it secure, it's a bad idea. If you want people to get files from it, it's a good idea, because very few client networks will allow active-mode ftp any more; it doesn't play well with NAT, and it requires them either to open up arbitrary port ranges, or have an adaptive firewall.
Basically, ftp has rather had its day, as a transfer protocol. If you're going to insist on using it (as opposed to, say, sftp) then put it on a disposable machine on a DMZ well walled-off from the core network; and if you have a good adaptive firewall, that can help mitigate the risk of leaving that port range open.
Passive FTP ports are not bad.
First of all FTP Passive Ports are transient. Meaning that there should be nothing on these port unless there is an active transfer.
Second, most FTP Servers allow you to specify a passive port range. So instead of opening up 1000 ports (so you could do 1000 concurrent transfers) you could open 20 ports (or even less if your concurrent number of users is small) to allow fewer concurrent transfers. I have seen FTP Servers running with only 5 passive ports opened.
Third, you can install SSL and run your server in an implicit FTPS mode, most FTP clients support FTPS. This is by far the best thing you could do, the issue of passive ports is probably less relevant then securing the FTP connections.
