Does an unused ftp account pose a security risk?

Question

I'm using BlueHost and have a few websites on my hosting. I decided to stop being lazy and start implementing some better security policies on my own part.

Since FTP isn't secure, I changed to SFTP. The odd thing is that BlueHost won't let me delete two of the FTP accounts on my BlueHost account. If these two accounts are never used, are they still a security risk?

that you for being open and honest about an org's sec; a lot of posters play coy with naming names — dandavis, Jun 17 '17 at 18:22

score 3 · Accepted Answer · answered Jun 16 '17 at 23:19

3

The short, non-nuanced answer is "Yes". Even if the accounts are unused there is still a risk of brute force.

A longer answer would be "Yes, but you can greatly mitigate the risk". I know you said you changed to SFTP, but I'm not clear if you've disabled the FTP service completely. A good chunk of the risk here can be mitigated if you're able to (or already have) harden the server by disabling FTP.

Additionally, if these users only have the ability for FTP logon you'll further reduce the risk. It's going to be difficult to exploit FTP accounts if there is no FTP service running and the accounts can only log into FTP.

I haven't run anything on Bluehost so I don't know how much control they give you over the above.

answered Jun 16 '17 at 23:19

James Valente

46
2

I can't find a way to disable FTP altogether... Bluehost can be a bit odd. – Jacob Henning Jun 16 '17 at 23:34
Do they allow you to change the passwords to the accounts? In this case, you might be able to at least reduce the chance of them being bruteforced. If you try to use the accounts for SFTP/SSH do the accounts log in at all? – James Valente Jun 16 '17 at 23:48
The SFTP has one login identical to the FTP – Jacob Henning Jun 17 '17 at 00:38
I can change the password for both, because the passwords are the same as my login. – Jacob Henning Jun 17 '17 at 00:38

score 0 · Answer 2 · answered Jun 17 '17 at 15:35

Yes, the represent a risk. If someone managed to brute force the passwords then there may be a vulnerability in the software that allows the users to get access to files they shouldn't be able to access or even do some sort of privilege escalation and get control of the process and possibly the system. While not likely, it is possible.

If you can't disable FTP or the accounts at least make the passwords super long and complicated so that it's unlikely they'll be brute forced.

Does an unused ftp account pose a security risk?

2 Answers2