Hello,

i am new to linux and am wondering what the security implications are if a local user name and password gets into the hands of the wrong people.

Why i ask this is because i'm doing an ftp upload and for this i've created a java applet, that has a hard coded username and password. It's fairly easy to decompile java code and get access to this user information - who is the apache user.

Is this a big problem? If i restrict ssh to only allow one user eg ssh_user then what harm can a cracker do, armed with my apache user name and password? What other means are there of making use of this? Telnet is disabled...Can this be used to access my system in any other way?

Thanks!

hagen

Wouldn't a better question be "How do I configure FTP so uploads do not require a userid and password?" I believe that this is the way almost all ftp sites are configured, and the risk, however small, of exposing user names and passwords is avoided.

And haven't you somewhat increased you risk by advertising, in a public forum, your intent to make your system's user name and password part of your script?

As to the answer to my proposed question, there are several documents available (here and elsewhere) which provide such methods -- and I'm not actually knowledgeable enough to offer any better advice than the common one to RTM.

Hi,

thanks for your reply. I can configure vsftpd to use anonymous uploads (it should do so by default) but for some reason my vsftpd server doesn't like anon connections. But i'm sure i can fix that somehow. So i'm not asking for ftp setup help.

My question was actually just what harm people can do with a username and password combination...judging from your reply...lots of harm it seems. But how? Through ssh? That can be made secure quite easily i think. How else? How else can remote users log into your system with a username and password combination...

Thanks

h

The problem is that there are lots of clever people out there, and it only takes one of them to find a way to exploit your system. Handing them the keys doesn't make it harder. My point: I'm not sure what specific problems you'd have, but strongly suspect that you don't want to find out.

I was just looking at another post, and found a reference to "http://pureftpd.sourceforge.net/" which is a "Secure" FTP server. I did understand that you weren't looking to replace your FTP server, but you might want to take a look at that one.