2

Whats a good FTP server? I have been running FileZilla, which seems okish. But I've noticed that a lot of people try to hack ftp servers and FileZilla only has very basic controls to prevent people from hacking. (so far no ones actually managed to get in... so thats good!)

I was wondering if there were better options out there? Especially interested in recommendations from people who know they get targeted by hackers.

Keith Nicholas
  • 165
  • 1
  • 1
  • 13

3 Answers3

6

There's not really any such thing as a "secure" FTP server - you have to switch to SFTP or FTPS if you want real security. There's a lot of reasons why (plain text passwords being just one).

The catch with SFTP is that a lot of your favourite clients might not support it. For a more detailed discussion, check this question here: FTP v/s SFTP v/s FTPS - your solution will depend on how many users you need to support.

Community
  • 1
Mark Henderson
  • 68,316
  • 31
  • 175
  • 255
  • 1
    there's more to being secure then enabling a layer of encryption. Encryption is the start, but it's not the only thing to consider. – The Unix Janitor Apr 11 '10 at 23:05
  • 1
    @user37899, I really don't think Farseeker was implying that encryption is the only issue. The key point is that FTP is insecure ALWAYS. – John Gardeniers Apr 12 '10 at 00:42
0

Just run a SFTP server on a port that is not the standard port SSH port 22. Instead , run your SFTP server on port 2222 or something. "Security through obscurity."

My second favorite SFTP server is "NULL FTP Server".

djangofan
  • 4,172
  • 10
  • 45
  • 59
0

As has previously been noted, you need to use SFTP or FTP over SSL to have a secure protocol. There are several other considerations, as well, if you want a secure server:

  1. There should be functions that can detect DoS attacks and block FXP
  2. There should be an ability to block users and IP addresses
  3. Passwords should be encrypted (MD4 and MD4 password encryption) rather than sent in plain text.
  4. Administrators should have the ability to implement password policies that force creation of complex passwords.
  5. Kick out users that issue too many bad commands or log-in attempts
  6. If possible, you should disable anonymous access to the server
  7. Depending on how many internal users would have access to the native directory structure, you may want to consider a server that offers PGP encryption of the files stored on the server.
KimSRT
  • 21
  • 2