Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I opened ftp command prompt and typed open mydomain.com, it gave me the following and I think that this is a security vulnerable.

connected to mydomain.com.
220----- Welcome to Pure-FTPd [privsep] [TLS] -----
220- you are user number 1 of 50 allowed.
220- local time is now 13:18. Server port: 21
220- IPv6 connections are also welcome on this server.
220  you will be disconnected after 15 minutes of inactivity.
user <mydomain.com:<none>>:

However, when I tried another websites like open stackexchange.com, it returned nothing.

Can anyone tell me how to apply more security on ftp connections on my server?

share|improve this question
    
Do I understand correctly that your primary concern is the amount of information your server hands out? The tips in the answers are much more important. –  guntbert Mar 3 at 20:28

4 Answers 4

You can't secure FTP. Remove it and replace with a secure alternative like SFTP if you need file transfer. The way in which you've asked the question implies that you don't have a valid need for it, that it's probably just on by default.

Depending on what you're running, 'rpm -e pure-ftpd' or 'dpkg -r pure-ftpd' might do for you.

share|improve this answer

FTP is a very old protocol and not recommended anymore today because credentials are transmitted in plaintext which can be read by sniffing the network traffic.

If you don't need it you should uninstall it or you can block this port with a firewall. On Linux you could use iptables to block all traffic to this port as follows:

iptables -A INPUT -p tcp --dport 21 -j DROP

You should also scan your host for other open ports which you don't need. You can do it with nmap:

nmap mydomain.com

If nmap lists ports as open which you don't need you can block traffic to those ports similar to the iptables command giben above. Just replace the 21 wih the appropriate port number.

share|improve this answer

To echo Gowenfawr, if you don't need it, disable/uninstall it. However if you do need FTP then there are some things you can do to control access.

  • Review the FTP configuration to make sure permissions are as granular as possible. Look at the user rights for ftp to see what directories are allowed for those users. Limit them as much as possible.
  • If the people who access your system via FTP come from known networks or IP's, you can limit access to port 21 via firewall rules (if you're running a host based firewall) or many FTP packages allow you to limit access by IP.
  • Modify your connection message to give out as little information as possible, you probably just want a message saying to the effect: Authorized access only, etc...
  • Check your ftp logs periodically, look for unusual activity (amount of upload/downloads, size of uploads/downloads).

Typically your ftp server may be used to exfiltrate data (if you have desired data on your system), used to host files for distribution to others (using your bandwidth/storage), or a waypoint exfiltraing data from a hacked site.

share|improve this answer

Whilst the lack of SSL/TLS or other transport security is definitely an issue, it is important to note that there's nothing here to suggest that your Pure-FTP server is misconfigured. You are meant to see this prompt before you authenticate against the server (username/password). It might be worth checking that you can't login by typing "Anonymous" at this prompt though.

As noted by @gowenfawr and @DanielE, the only real thing that's obviously insecure about your scenario in the lack of encryption and integrity checking. This means there's a potential for malicious third-parties to snoop on the data or credentials you send, and that you can't be sure you are talking directly to your server (man-in-the-middle). Don't get me wrong, this is a serious flaw. In this case, replace your FTP server with SFTP or FTPS.

The other issue might be that, if you're running an FTP server that you don't actually need, then you're increasing your overall attack surface unnecessarily, putting you at a greater risk of compromise. In this case, uninstall Pure-FTP.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.