Providing Web services to your intranet and the public Internet is almost a staple of being productive in today's business economy. In many cases, companies will use the products they are most familiar with or try to stay with a single vendor, and that often means Microsoft and Windows NT Server, Windows 2000 Server, or soon to be Windows .NET Server.
Internet Information Server (IIS) ships with Microsoft's server products. IIS provides an excellent Web platform, but what many often forget is that it also provides an FTP server (many Web server products ship with an FTP server or offer separate FTP server products, not just Microsoft's).
FTP is a great tool for transferring files too large to send via e-mail or simply to provide a repository of files for customers or employees to peruse and download. But there are serious security problems you must be aware of.
- First, FTP can allow anonymous logons and/or logons using local or domain user accounts -- a major back door into your systems if it's enabled.
- Second, FTP is a non-encrypted protocol that transmits usernames and password in clear text.
- Third, under Windows NT, 2000 and .NET, FTP logons are not subject to account-lockout restrictions.
- Fourth, Windows NT and Windows 2000 both install IIS as a default component.
Windows NT's IIS has a default active FTP site. Windows 2000's IIS does not create a default FTP site. Windows .NET does not install
It would be easy for a cracker to sniff packets off your Internet link looking for user accounts and passwords, or to initiate a brute-force attack against a known user account without fear of that account's being locked out.
If you don't know if you installed FTP, whether it is active, properly configured, or even if FTP is a product included with your Web server, its about time you find out. With a Microsoft OS, open the services dialog and look for FTP. If it's operating, at least you know.
Solutions to these problems include:
- Avoid using FTP if at all possible.
- If file transfer is necessary, configure an FTP server on a stand alone system with no valuable data stored on it.
- Look for a secure file transfer solution, such as using HTTP 1.1 and SSL to offer file transfer via Web sites.
- Audit access to your FTP root and server in general.
About the author
James Michael Stewart is a researcher and writer for Lanwrights, Inc.
This was first published in January 2002