Close the FTP open door

Providing Web services to your intranet and the public Internet is almost a staple of being productive in today's business economy. In many cases, companies will use the products they are most familiar with or try to stay with a single vendor, and that often means Microsoft and Windows NT Server, Windows 2000 Server, or soon to be Windows .NET Server.

Internet Information Server (IIS) ships with Microsoft's server products. IIS provides an excellent Web platform, but what many often forget is that it also provides an FTP server (many Web server products ship with an FTP server or offer separate FTP server products, not just Microsoft's).

FTP is a great tool for transferring files too large to send via e-mail or simply to provide a repository of files for customers or employees to peruse and download. But there are serious security problems you must be aware of.

• First, FTP can allow anonymous logons and/or logons using local or domain user accounts -- a major back door into your systems if it's enabled.
• Second, FTP is a non-encrypted protocol that transmits usernames and password in clear text.
• Third, under Windows NT, 2000 and .NET, FTP logons are not subject to account-lockout restrictions.
• Fourth, Windows NT and Windows 2000 both install IIS as a default component.

Windows NT's IIS has a default active FTP site. Windows 2000's IIS does not create a default FTP site. Windows .NET does not install IIS as a default component and does not create a default FTP site. So you may have an FTP server active and not even know it.

It would be easy for a cracker to sniff packets off your Internet link looking for user accounts and passwords, or to initiate a brute-force attack against a known user account without fear of that account's being locked out.

If you don't know if you installed FTP, whether it is active, properly configured, or even if FTP is a product included with your Web server, its about time you find out. With a Microsoft OS, open the services dialog and look for FTP. If it's operating, at least you know.

Solutions to these problems include:

• Avoid using FTP if at all possible.
• If file transfer is necessary, configure an FTP server on a stand alone system with no valuable data stored on it.
• Look for a secure file transfer solution, such as using HTTP 1.1 and SSL to offer file transfer via Web sites.
• Audit access to your FTP root and server in general.
  
  About the author
  James Michael Stewart is a researcher and writer for Lanwrights, Inc.
  
  

  Rate this Tip To rate tips, you must be a member of SearchSecurity.com. Register now to start rating these tips. Log in if you are already a member. Submit a Tip BROWSE BY TAG Web Security Advisor,   Securing the Internet and E-Commerce,   VIEW ALL TAGS Digg This!     StumbleUpon     Del.icio.us    RELATED CONTENT Web Security Advisor DNS rebinding defenses still necessary, thanks to Web 2.0 New defenses for automated SQL injection attacks PCI compliance and Web applications: Code review or firewalls? Worst practices: Bad security incidents to avoid Web scanning and reporting best practices Social networking Web site threats manageable with good enterprise policy Enterprise security in 2008: Building trust into the application development process PCI DSS Section 6: A plan for tackling application security Making the case for Web application vulnerability scanners Preparing for uniform resource identifier (URI) exploits Securing the Internet and E-Commerce Sensitive student data cracked at U. of Georgia Microsoft patches IE spoofing problem IE update clears up spoofing issue Countdown begins for Mydoom DDoS attacks Microsoft to disable spoofing syntax in IE IE flaw could fool users in illicit downloads Mydoom variant targets security features, Microsoft Hackers scanning for ports opened by Mydoom Dangerous, familiar application vulnerabilities top list Potent Mydoom worm flooding inboxes RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.