Anonymous FTP Security Settings

Anonymous FTP is a frequently used service on the Internet. It is often used for Software Download websites and software exchange websites.
We will discuss the security of the highly anonymous FTP service during its opening process.
The following settings are composed of the experience and suggestions accumulated by many websites in the past. We believe that some
The desired website has different settings.
Set anonymous FTP
A. FTP daemon
The website must be sure to use the latest FTP daemon version.
B. Set the anonymous FTP directory
Root directory of anonymous ftp (~ And its sub-directory owner cannot be an ftp account, or an account in the same group as ftp. This is
Common setup problems. If these directories are owned by ftp or accounts in the same group as ftp, they are not properly prevented.
With the write protection, intruders may add files (for example,. rhosts hosts) or modify other files. Many websites? Oo oot account. Set the root directory and sub-directory owner of anonymous FTP to root and the group to system? Why are there too many other users? Such as chmod 0755), so only root has the write power, which can help you maintain the FTP service security ??
The following is an example of setting an anonymous ftp directory:
Drwxr-xr-x 7 root system 512 Mar 1 ./
Drwxr-xr-x 25 root system 512 Jan 4 ../
Drwxr-xr-x 2 root system 512 Dec 20 bin/
Drwxr-xr-x 2 root system 512 Mar 12 etc/
Drwxr-xr-x 10 root system 512 Jun 5 pub/

All files and link libraries, especially those used by FTP daemon and ~ Ftp/bin and ~ Text in ftp/etc
File, which should be the same as the directory in the preceding example. These files and linked libraries should not be used by the ftp account or
In addition to accounts owned by the same group of tp, data cannot be written.

C. How can I use the cooperation partner to raise funds? We strongly recommend that the website do not use/etc/passwd in the system ~ The password file in the ftp/etc directory or
In/etc/group ~ Group files in the ftp/etc directory. In ~ Put these files in the ftp/etc directory
Attackers obtain them. These files are customizable and not used for access control.

We recommend that you ~ Ftp/etc/passwd and ~ Ftp/etc/group uses a replacement file. These files must be
T. The DIR command uses this file to display the owner and group names of the file and directory. The website must be
Ding ~ The/ftp/etc/passwd file does not contain any account names that are the same as those in the/etc/passwd file in the system. These
The file should only contain the owner and group name of the file and directory in the FTP class architecture to be displayed. In addition
The password setting field is "sorted. For example, use "*" to replace the password field.

Example of anonymous ftp password file in cert
Ssphwg: *: 3144: 20: Site Specific Policy Handbook Working Group ::
Cops: *: 3271: 20: COPS Distribution ::
Cert: *: 9920: 20: CERT ::
Tools: *: 9921: 20: CERT Tools ::
Ftp: *: 9922: 90: Anonymous FTP ::
Nist: *: 9923: 90: NIST Files ::

Example of anonymous ftp group files in cert
Cert: *: 20:
Ftp: *: 90:

 

II. Provide writable directories on your anonymous ftp

There is a risk that an anonymous ftp service allows users to store files. We strongly recommend that you do not create one automatically.
Upload directories, unless related risks have been taken into account. The CERT/CC event returns that the member receives many upload directories.
Illegal transfer of copyright software or exchange of account and password information. The system file is also maliciously reported as denial.
Of service issues.

This section describes how to solve this problem using three methods. The first method is to use a corrected FTP daemon. The
The two methods provide write restrictions on specific directories. The third method is to use an independent directory.

A. Modified FTP daemon
If your website plans to provide directories for file upload, we recommend that you use the corrected FTP daemon to upload files.
Directory for access control. This is the best way to avoid unnecessary write areas. The following are some suggestions:

1. Restrict that the uploaded files cannot be accessed again, so that they can be detected by the system administrator and placed in the appropriate location for users to download.
.
2. restrict the size of each online uploaded data.
3. limit the total amount of data transmitted according to the size of the existing disk.
4. Add logon records to detect improper use in advance.

If you want to modify the FTP daemon, you should be able to get the program code from the vendor, or you can get the code from the following places
The public FTP original code:
Wuarchive.wustl.edu ~ Ftp/packages/wuarchive-ftpd
Ftp.u.net ~ Ftp/systems/unix/bsd-sources/libexec/ftpd
Gatekeeper.dec.com ~ Ftp/pub/DEC/gwtools/ftpd.tar. Z

CERT/CC does not officially inspect, evaluate, or endorse the aforementioned FTP daemon. What FTP daemon to use
Each user or organization is responsible for the decision, and CERT/CC recommends that each agency do one before installing and using these Procedures
A thorough assessment.

B. Use Protected Directories
If you want to provide the upload service on your FTP site, and you cannot modify the FTP daemon, we can
Use a complex directory architecture to control access. This method needs to be planned in advance and cannot prevent FTP writable areas.
The domain is improperly used, but many FTP sites still use this method.

To protect the upper-layer directories (~ Ftp/incoming), we only grant anonymous users permission to access the directory (chmod 751
~ Ftp/incoming ). This action allows the user to change the directory location (cd), but does not allow the user to view the Directory
Content. Ex:
Drwxr-x -- x 4 root system 512 Jun 11 incoming/

In ~ Ftp/incoming uses some directory names for only the persons you allow to upload them. To make it difficult for others to guess Directories
Name. You can use the password setting rule to set the directory name. Do not use the directory name example in this article (avoid
Find your directory name and upload the file)
Drwxr-x-wx 10 root system 512 Jun 11 jajwu22/
Drwxr-x-wx 10 root system 512 Jun 11 :54 MhaLL-iF/

It is very important that once the directory name is intentionally or unintentionally leaked, this method has no protection effect. As long
If the directory name is known to most people, it cannot protect the restricted areas. If the directory name is known to everyone,
Then you have to delete or change the directory names.

C. Use only one hard disk:
If you want to provide the upload service on your FTP site, but you cannot modify the FTP daemon,
You can centralize all uploaded data in the same mount ~ File System on ftp/incoming. Yes
, Mount a separate hard disk in ~ Ftp/incoming. The system manager should continuously check this directory (~ Ftp/
Incoming), so you can know whether there is a problem with the open upload directory.

 

 

Restrict FTP User Directories
Anonymous FTP can effectively restrict user activity within the specified directory, but official FTP users are not affected by default.
In this way, he can freely read some contents in the root directory, system directory, and other user directories to allow others to use
Files Read by the user.
How can I restrict specified users to their own directories like anonymous users? We use red hat and
Wu-ftp is used as an example.
1. Create a group and use the groupadd command. Generally, you can use an ftp group or any group name.
----- Related command: groupadd ftpuser
----- Related file:/etc/group
----- Help: man groupadd
2. Create a user, such as testuser, and create a user. The adduser command is available if you have created testuse
R Users can directly edit the/etc/passwd file and add the user to the ftpuser group.
----- Related command: adduser testuser-g ftpuser
----- Related file:/etc/passwd
----- Help: man adduser
3. Modify the/etc/ftpaccess file and add it to the guestgroup definition: guestgroup ftpuser,
Add the last five rows.
Compress yes all
Tar yes all
Chmod no anonymous
Delete no anonymous
Overwrite no anonymous
Rename no anonymous
Chmod yes guest
Delete yes guest
Overwrite yes guest
Rename yes guest
Guestgroup ftpuser

In addition to adding the guestgroup ftpuser line, the other four lines must also be added. Otherwise, after the user logs in
You cannot return the purpose of the parent directory, but you can only upload it. You cannot overwrite or delete files!

----- Related command: vi/etc/ftpaccess
----- Related file:/etc/ftpaccess
----- Help: man ftpaccess, man chroot

4. Copy the necessary files to the root directory of the user, copy the directory that comes with the ftp server, and
The bin and lib directories are copied to the root directory of the user. Some commands (mainly ls) need to be supported by Lib. Otherwise
You cannot list directories and files.

----- Related commands:
Cp-rf/home/ftp/lib/home/testuser; cp-rf/home/ftp/bin/home/testuser

5. Do not forget to disable the user's telnet permission. Otherwise, it will be done in vain. Why not let the user telnet? Simple:
Add a/dev/null Line to/etc/shells, and then you can directly edit the/etc/passwd file.
The shell of the user can be set to/dev/null.

----- Related commands: vi/etc/passwd
This step can be completed first when you create a user in step 2.
----- Related command: adduser testuser-g ftpuser-s/dev/null
Small experience: you only need to cp the bin and lib directories under/home/ftp to the/etc/skel directory and create a new one later.
The user automatically adds the bin and lib directories to the user directory. Of course, you can also add public_html
And cgi-bin directory.
After the preceding settings, all FTP operations of the user testuser are restricted to the/home/testuser directory.