0

Somebody had been trying to brute force my FTP server with a username the doesn't even exist, but it got me thinking I should upgrade my security. It would be impractical to filter by IP as the places I access it from will have dynamic IP, but I was thinking of setting up a Dynamic Domain service which points to my computer and then only allowing connections to filezilla from that domain.

However when I try to set up IP filtering on FileZilla using the domain it says invalid IP (As it obviously isn't an IP)

So is there a solution to this? Use a different FTP server that can do it, plugin for filezilla or other security suggestion?

4
  • You should tag your FTP server's OS in use to get a better answer
    – thinice
    Jan 23, 2012 at 20:30
  • 1
    If you're serious about security you should consider using something other than FTP. Jan 23, 2012 at 20:56
  • @JohnGardeniers What would be the alternative?
    – Joel
    Jan 24, 2012 at 1:47
  • @Joel, it really depends on what options are available to you but something like SFTP would be much preferable. FTP was designed for closed networks where security really wasn't much of an issue. Jan 24, 2012 at 4:34

1 Answer 1

0

Filezilla has an autoban feature builtin. this bans a user after xx failed logins for an amount of time. This would slow down any brute force attempt. Since you use dynamic IP's to access it, you cannot filter easily.

Next you could look into more secure FTP connections, SFTP...

The better solution would be to use SSH or VPN to connect to the server before using FTP. This would allow you to securely access the server before sending FTP credentials.

Brute forcing is going to happen, fail2ban or autoban are about the best deterrents, even if you use SSH, nothing prevents them from trying to brute force the SSH account.

Moving the service to an uncommon port provides some obfuscation, but no real extra security.

2
  • I've been a little put off by the auto-ban feature as it can be used in denial of service attacks if abused but considering I can also access it by remote access it may be an option. I'll certainly look into SSH and VPN though, thanks :D
    – Joel
    Jan 24, 2012 at 0:11
  • Actually further consideration lead me to question the need for FTP at all, I was only using for convince within dreamweaver and since then ive started using dropbox to backup SQL so I think ill use a VPN for remote access and then a secure password for dropbox.
    – Joel
    Jan 24, 2012 at 0:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .