Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Somebody had been trying to brute force my FTP server with a username the doesn't even exist, but it got me thinking I should upgrade my security. It would be impractical to filter by IP as the places I access it from will have dynamic IP, but I was thinking of setting up a Dynamic Domain service which points to my computer and then only allowing connections to filezilla from that domain.

However when I try to set up IP filtering on FileZilla using the domain it says invalid IP (As it obviously isn't an IP)

So is there a solution to this? Use a different FTP server that can do it, plugin for filezilla or other security suggestion?

share|improve this question
    
You should tag your FTP server's OS in use to get a better answer –  thinice Jan 23 '12 at 20:30
1  
If you're serious about security you should consider using something other than FTP. –  John Gardeniers Jan 23 '12 at 20:56
    
@JohnGardeniers What would be the alternative? –  Joel Jan 24 '12 at 1:47
    
@Joel, it really depends on what options are available to you but something like SFTP would be much preferable. FTP was designed for closed networks where security really wasn't much of an issue. –  John Gardeniers Jan 24 '12 at 4:34

1 Answer 1

up vote 0 down vote accepted

Filezilla has an autoban feature builtin. this bans a user after xx failed logins for an amount of time. This would slow down any brute force attempt. Since you use dynamic IP's to access it, you cannot filter easily.

Next you could look into more secure FTP connections, SFTP...

The better solution would be to use SSH or VPN to connect to the server before using FTP. This would allow you to securely access the server before sending FTP credentials.

Brute forcing is going to happen, fail2ban or autoban are about the best deterrents, even if you use SSH, nothing prevents them from trying to brute force the SSH account.

Moving the service to an uncommon port provides some obfuscation, but no real extra security.

share|improve this answer
    
I've been a little put off by the auto-ban feature as it can be used in denial of service attacks if abused but considering I can also access it by remote access it may be an option. I'll certainly look into SSH and VPN though, thanks :D –  Joel Jan 24 '12 at 0:11
    
Actually further consideration lead me to question the need for FTP at all, I was only using for convince within dreamweaver and since then ive started using dropbox to backup SQL so I think ill use a VPN for remote access and then a secure password for dropbox. –  Joel Jan 24 '12 at 0:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.