I found some FTP servers in a network that seem to allow login with an anonymous FTP user. I confirmed this with the ftp-anon
NSE script in Nmap.
PORT STATE SERVICE
21/tcp open ftp
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
But when I try to connect with an anonymous user using an FTP client like FileZilla, it seems that this FTP user does not have any rights.
Status: Connecting to X.X.X.X:21...
Status: Connection established, waiting for welcome message...
Status: Insecure server, it does not support FTP over TLS.
Status: Server does not support non-ASCII characters.
Status: Logged in
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/" is current directory
Command: TYPE I
Response: 200 Command successful
Command: PASV
Response: 227 Entering Passive Mode(X,X,X,X,004,001)
Command: LIST
Error: The data connection could not be established: EAI_NONAME - Neither nodename nor servname provided, or not known
Error: Connection timed out after 20 seconds of inactivity
Error: Failed to retrieve directory listing
Status: Disconnected from server
So am I right to assume that this FTP server does allow a connection with an anonymous user but that anonymous user doesn't have any rights? If so, would the right recommendation still be to disallow anonymous FTP users or won't that make any difference? Also, what are the risks of above scenario?