Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

my ftp was hacked, a file has been uploaded and the host suspended the website temporarily. I'm only using an admin page that points to an xml file (to load and modify the text of my website), i don't have any database, how can i protect the ftp to have the same problem in the future?

i'm going to add a htaccess / htpasswd, but will it be enough?

thanks for your help

share|improve this question
Ask your hosting company what you should do. I would also disable the FTP account until you need it. What I mean by this is that, you were given a FTP username by the hosting company ( DO NOT USE THIS ACCOUNT EVER ), create a "child" account and enable/disable that account each time you have to upload something. – Ramhound Mar 7 '12 at 12:59

2 Answers

up vote 5 down vote accepted

I wonder how you know that FTP was the method by which the unwanted file was uploaded. FTP is definitely problematic in that it defines no countermeasures against eavesdropping. You can find out about using a different protocol. You could consider the discussion of alternatives at SFTP, FTPS and SecureFTP differences and security implications. You will also want to ensure that you use a strong password (or passphrase). Roughly, a strong password is not in the first billion guesses. That way, if an attacker can find a way to try 100 guesses per second, your password can still resist attack for a month.

share|improve this answer
hi, yes i don't know, can he send a file to the FTP using the input field in the admin page, even if i set htmlspecialchars on my login/password? will it change something to add a "htaccess" file? the password is 12 letters length, with numbers etc. – Paul Mar 8 '12 at 11:25
1  
OK, I think we misunderstood that you might be uploading via FTP protocol. Because you are in fact uploading via the mechanism called "HTTP upload", yes, htaccess/htpasswd is advisable. There is a risk that you should be aware of. If you have to use "AuthType Basic" you will be at risk of further problems. Please see about using "AuthType Digest". "Require" directives, if available, might be a workable alternative or supplement. I haven't explained all the details, but you can get them starting with the tutorial: httpd.apache.org/docs/current/howto/htaccess.html – minopret Mar 8 '12 at 15:19
thanks minopret – Paul Mar 8 '12 at 16:49
up vote 3 down vote

i'm going to add a htaccess / htpasswd

These files are usually used by webservers - not ftp servers. Some ftp servers will look for such files but you didn't say what ftp server you are using.

However since the FTP protocol sends passwords in clear text, and there's the additional complications around the secondary data channel, really you should use something else if you're really concerned about security (scp or sftp).

Since your "host suspended the website temporarily" your not hosting the site yourself - so what level of control over the server do you have? Even if you don't have root access, the hosting company may already provide ssh access (which usually implies scp or sftp).

Do make sure you pick a strong password.

share|improve this answer
thanks symcbean, the password is strong, with numbers etc. i set htmlspecialchars on my input (just one in the admin page), will it change something to add a htaccess file? (i just have a xml file, no database, but i don't know if it changes anything) – Paul Mar 8 '12 at 11:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.