FTP security
Anonymous FTP and bounce attacks
Treat anonymous publishing as a narrow policy choice and understand why unrestricted PORT commands are dangerous.
Anonymous FTP lets people download public files without a personal account. Log in as anonymous or ftp, often with an email address as the password:
$ ftp files.partner.test
220 FTP server ready
Name: anonymous
331 Password required
Password: [email protected]
230 Login successful
ftp> ls
150 Opening data connection
226 Transfer completeThat sounds harmless until the server exposes the wrong directories or accepts uploads from strangers. Anonymous still runs as a real account with real permissions. Lock it down like one.
I treat anonymous FTP like a public web directory, not like “no login means no risk.” Write permissions and upload paths on a sticky note next to the server config. Anyone on the internet can read what you expose.
A worse problem is the FTP bounce attack. A client sends PORT and asks your server to open a data connection to someone else:
PORT 198,51,100,20,0,25
200 PORT command successful
RETR small-filePort 25 on host 198.51.100.20 is SMTP. A misconfigured server could be tricked into connecting to another machine on the attacker’s behalf.
A safe server rejects PORT endpoints that do not match the client’s address and blocks privileged ports.
Anonymous access should still be jailed to a read-only public root. No home directories, no write access to web roots, no outbound active mode if you can disable it.
Passive mode stops this particular relay trick because the client connects to the server, not the other way around. It does not fix sloppy anonymous upload folders.
Log in anonymously on a test server and list what you can reach. Then try active PORT to an address you control and confirm the server refuses it.
Review the anonymous root and active-mode settings before you expose anonymous FTP to the internet.
Lesson completed