[48042] in North American Network Operators' Group
Re: DoS on ftp port
daemon@ATHENA.MIT.EDU (Anthony D Cennami)
Tue May 21 13:03:19 2002
Message-ID: <3CEA7D83.6000808@netscape.net>
Date: Tue, 21 May 2002 13:01:55 -0400
From: Anthony D Cennami <acennami@netscape.net>
MIME-Version: 1.0
To: David.Charlap@marconi.com
Cc: NANOG <nanog@merit.edu>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Errors-To: owner-nanog-outgoing@merit.edu
In addition to David's suggestion, you would also want to ensure that
newly create files are umasked unreadable as well. Should the directory
be masked unreadable but still executable (which it must be to actually
enter it) users could still externally link to the files, even though
one could not view them in a directory listing.
David.Charlap@marconi.com wrote:
> Rob Thomas wrote:
>
>>There is a huge increase in FTP scanning as well as the building of
>>warez botnets. The warez scanning is generally for anonymous FTP
>>servers with plentiful bandwidth, copious disk space, and generous
>>write permissions. ...
>>
>
> One things I know of that helps here is to make sure you never have a
> single directory that is both readable and writeable to an anonymous
> user.
>
> In general, restrict writing to users with logins and passwords. If you
> must have an anonymous-write directory (like an incoming folder), make
> sure that that directory is not also readable by anonymous users.
>
> This probably won't eliminate all the abuse, but it should make it
> impractical enough that the warez servers will probably start looking
> elsewhere.
>
> -- David
>
