remove users from ftp site

28 Aug 2006 12:34 PM

cmyar

just amde a ftp server. iis 6.0 box sits on the ISP outside the firewall.
going over the windows firewall log i notice that even though I renamed the
administrator account when using it as a username ftp accepts it. I have
also disallowed anonymous connections and when using anonymous as a user ftp
still says it accepts the username. is this normal behavior or did I miss
something in the security setup?

28 Aug 2006 2:12 PM

Funkadyleik Spynwhanker

Are you actually logging in with the Administrator account?

The FTP service seems to accept connections and not reject for a username,
instead coming up with the default "authentication denied" thing.

I assume that is to prevent the brute force guessing of usernames and is
expected behavior. Likewise for the IP address restriction, it doesn't
disallow for making a connection, but rules out logging in at all.

Show quoteHide quote

"cmyar" <cm***@discussions.microsoft.com> wrote in message
news:F6F01B53-4EB0-4C25-93A6-1636A3B6120D@microsoft.com...
> just amde a ftp server. iis 6.0 box sits on the ISP outside the
> firewall.
> going over the windows firewall log i notice that even though I renamed
> the
> administrator account when using it as a username ftp accepts it. I have
> also disallowed anonymous connections and when using anonymous as a user
> ftp
> still says it accepts the username. is this normal behavior or did I miss
> something in the security setup?

28 Aug 2006 2:24 PM

cmyar

no i can't log in with the administrator account. it still concerns me that
the administrator account and the anonymous user are accepted users

Show quoteHide quote

"Funkadyleik Spynwhanker" wrote:

> Are you actually logging in with the Administrator account?
>
> The FTP service seems to accept connections and not reject for a username,
> instead coming up with the default "authentication denied" thing.
>
> I assume that is to prevent the brute force guessing of usernames and is
> expected behavior. Likewise for the IP address restriction, it doesn't
> disallow for making a connection, but rules out logging in at all.
>
> "cmyar" <cm***@discussions.microsoft.com> wrote in message
> news:F6F01B53-4EB0-4C25-93A6-1636A3B6120D@microsoft.com...
> > just amde a ftp server. iis 6.0 box sits on the ISP outside the
> > firewall.
> > going over the windows firewall log i notice that even though I renamed
> > the
> > administrator account when using it as a username ftp accepts it. I have
> > also disallowed anonymous connections and when using anonymous as a user
> > ftp
> > still says it accepts the username. is this normal behavior or did I miss
> > something in the security setup?
>
>
>

29 Aug 2006 3:54 AM

Bernard Cheah [MVP]

Well, it just like unknown users to the FTP server.
Of coz it will still accept it, but it will not authenticate it
successfully.

You can't prevent someone to knock on your door, right?

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/

Show quoteHide quote

"cmyar" <cm***@discussions.microsoft.com> wrote in message
news:2D53DB9E-59ED-497C-A9EF-0B98D422A9CC@microsoft.com...
> no i can't log in with the administrator account. it still concerns me
> that
> the administrator account and the anonymous user are accepted users
>
> "Funkadyleik Spynwhanker" wrote:
>
>> Are you actually logging in with the Administrator account?
>>
>> The FTP service seems to accept connections and not reject for a
>> username,
>> instead coming up with the default "authentication denied" thing.
>>
>> I assume that is to prevent the brute force guessing of usernames and is
>> expected behavior. Likewise for the IP address restriction, it doesn't
>> disallow for making a connection, but rules out logging in at all.
>>
>> "cmyar" <cm***@discussions.microsoft.com> wrote in message
>> news:F6F01B53-4EB0-4C25-93A6-1636A3B6120D@microsoft.com...
>> > just amde a ftp server. iis 6.0 box sits on the ISP outside the
>> > firewall.
>> > going over the windows firewall log i notice that even though I renamed
>> > the
>> > administrator account when using it as a username ftp accepts it. I
>> > have
>> > also disallowed anonymous connections and when using anonymous as a
>> > user
>> > ftp
>> > still says it accepts the username. is this normal behavior or did I
>> > miss
>> > something in the security setup?
>>
>>
>>

29 Aug 2006 4:08 PM

Funkadyleik Spynwhanker

"cmyar" <cm***@discussions.microsoft.com> wrote in message
news:2D53DB9E-59ED-497C-A9EF-0B98D422A9CC@microsoft.com...
> no i can't log in with the administrator account. it still concerns me
> that
> the administrator account and the anonymous user are accepted users
>

Ok, well you are misunderstanding the issue then.

Rejecting Users = bleeding data to an attacker. Telling them "Yes exists,
or No does not exist". If you get any kind of auditing, you will get dinged
for that as it opens you up to all sorts of social engineering attacks as
well as a focused brute force attack on the existing accounts. A single
variable isolated (the username) makes the problem to a "couple of months"
problem from a "longer than the universe has existed" problem.

Not rejecting users = giving them _nothing_ to start getting a foothold on.

You are thinking the first one is safer than the second one, which is
incorrect. The server should simply fail to login in _exactly_the_same_way_
no matter what it is that is wrong. Anything else, and you are giving away
information you don't want out there. You deleted the administration
account, now why do you want to ADVERTISE that fact?