Defending against ftp attacks

otacon 14112 · 03-29-2007, 01:54 PM

Hello,

I also have an ftp service running. I do know that any service can be hacked, and ftp is an old one, so there are probably a lot of vulnerabilities for it.

Anyway, what are some of the most common methods hackers use in order to compromise ftp services, and how would I defend/secure my server against them? I can't afford to have my server taken down.

Thanks alot, I appreciate it,
otacon

phantom_cyph · 03-29-2007, 02:25 PM

Here is a good place to ask that: click here.

kcorupe · 03-29-2007, 02:35 PM

when your saying that ftp is "old", you are referring to the protocol, there are new ftp servers/clients.

vsftpd is a proven secure ftp server in Linux, I would suggest that. Read up on some HOWTO's on google for configuring it properly, and I would suggest running it in a chroot environment for some added security.

Now, do you "need" to use ftp? why not use sftp (over ssh)? Its an encrypted connection and is much more secure then ftp.

nx5000 · 04-02-2007, 02:01 PM

A few things possible specific to ftp:
- Brute force attack (if ftp passwords are system password then it's really bad)
- Ftp protocol trick: ftp bounce attack (scanning, local/remote Dos by exhausting network ports)
- Guessing your internal network adresses (maybe enumerating NATed machines or the number)
- Guessing the architecture by getting /bin/ls (chroot or not)
- Probably other things..

It all depends on your settings and which ftp server is used

Chroot helps
sftp, ftps, scponly are good things to check