> I just set up a ftp server. I am using proftpd. Just wondering about
> the anonymous ftp user "ftp". What is the defualt password for this
> "user" and how do i change it, or is there a password. I made a
> direcory ftp in /home while logged in as root. The group and owner are
> therefore root, should I change this to the user "ftp" and group "ftp".
> I hope my ramblings are understandable.
User "ftp" should have a * or other impossible string in its passwd entry.
Anonymous ftp users are expected to send
USER anonymous
and be granted or denied access on criteria other than the password.
User "ftp" should not own any files whatsoever, except for anonymous
uploads (if you allow such). It should not have write access to any
files or directories, again except for the upload area.
Quote:> P.S. Any security concerns with proftpd? I did a little investigation
> and didn't find any thing major.
As with all ftp servers, passwords are transmitted in the clear.
Also, the server needs to bind to port 20 on every file transfer.
It must retain root privilege (or capability CAP_NET_BIND_SERVICE)
in order to do that. (Note: some ftp servers, notably publicfile,
violate the port-20 rule for the sake of greater security. I don't
know whether ProFTPD can be made to do this through configuration file
directives.)
by