Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently some of my webserver admin user credentials were comprimised as a part of an automated malware attack on my desktop machine where the crendentials were stored.

Following the cleanup and password changing phase, I came to the conclusion that this could feasibly happen in the future and as a result I want to better secure the admin FTP users on my webservers by moving them off port 21 or to administrative IP, either of which I can then control at the main firewall.

The problem is that Filezilla server doesn't support per-user port restrictions, and IP restrictions have to be managed via its interface, not practical with many webservers to manage. What I was after was specific IP binding at a per user level.

Is there an alternative FTP server app that will support this somehow? How easy or recommended would it be to install a second FTP server for administrative purposes on each server?

share|improve this question
4  
If you're using FTP then the protocol itself is insecure...passwords are sent in cleartext. –  Bart Silverstrim Jul 2 '10 at 17:08

1 Answer 1

up vote 1 down vote accepted

Bart Silverstrim has it - ftp is inherently insecure, consider sftp or ftp over ssh.

PASV ftp allows you to select ports other than 21. You connect to port 21, then PASV switches to another port, a port number > 1024. Passive mode is more secure than active mode, but not that much.

Why the above advice is bad - PORT command problem:

http://www.cert.org/tech_tips/ftp_port_attacks.html

Basically you should use ssl, scp or sftp. Not ftp. Filezilla supports sftp... FreeSSH and Cygwin provide sftpd - the sftp server.

share|improve this answer
    
I'm moving to a second instance of filezilla ftp running ftpes –  Chris Jul 23 '10 at 12:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.