[VirusHacker]

FTP is a protocol which defines a standard for transferring data over a network (RFC 765). Ftp programs can be categorized into two: the ftp server and ftp client. FTP was originally intended to facilitate the transfer of data from various remote computer is located. It can be known based on the objectives to be achieved by FTP, as found in RFC 765:

The objectives of FTP are:

1. to promotes sharing of files (computer programs and / or data),

2. to Encourage indirect or implicit (via programs) use of remote computers,

3. to shield a user from variations in file storage systems Among Hosts, and

4. to transfer data reliably and efficiently. FTP, though usable directly by a user at a terminal, is designed Mainly for use by programs.



Therefore, security issues become less important, but with the broader use of the Internet, then security becomes one of the main issues.

FTP has several disadvantages as follows:

* FTP using the authentication mechanism based on username / password standards. As a result, the server can not ensure that the user is really like what he said.
* By default passwords are sent in plaintext, so by using a sniffer, an attacker can retrieve their password.
* FTP Session not encrypted so there is no privacy.

In addition, if the server you have a directory that can be used by everyone to enter the data then there is a chance your server will be used as a pirate softwares repository.

Some things can be done to reduce the possibility of holes on the FTP server is:

* Using the ftp server software is relatively safe, for example proftpd (www.proftpd.org) and BSD FTP (www.openbsd.org).
* Limit orang-orang/host-host who may access it by modifying the files / etc / ftphosts and / etc / ftpusers.
* If no directory is reserved for file uploads, limit the space provided.
* Make sure the file permissions for the following files are correct. If you have not set the following files:

- Chmod 555 [ftp-home] ftp /

- Chmod 555 [ftp-home] ftp / bin

- Chmod 111 [ftp-home] ftp / bin / ls

- Chmod 555 [ftp-home] ftp / etc

- Chmod 444 [ftp-home] ftp / etc / passwd

and set the ownership of the files on the root

chown-R root [ftp-home] ftp /

* Make sure the directory / bin there is not a shell script that can run something we do not want.

Use replacement programs such as scp (client) and sshd (server) located on the OpenSSH (www.openssh.com). By using these two programs, data transmission is done in encrypted form.

[.LiT]

Thanks I liked this guide. You should now add to it. Some suggestions maybe you could add how to hack an FTP server maybe throw some default username and passwords for FTP servers or commonly used ones. How to connect to an FTP server from the command line in linux etc.

[VirusHacker]

Thanks I liked this guide. You should now add to it. Some suggestions maybe you could add how to hack an FTP server maybe throw some default username and passwords for FTP servers or commonly used ones. How to connect to an FTP server from the command line in linux etc.

U're welcome and Thanks for your suggestion, Maybe sometime I will try your suggestion.



Thank you very much

[Hacker.]

thank you but could you give us an example?

[slbmeh]

If you must use FTP instead of S/FTP do it through an ssh tunnel where possible. This will hide your plain text passwords and data. Also install and configure fail2ban...

Edit: oh... and chroot it...