FTP Server

NightShade03NightShade03 Member Posts: 1,383 ■■■■■■■□□□
Hey all,

I just setup an FTP server on a Windows 2003 box using IIS and the built in ftp server. I opened the ports on the firewall and forced the ftp server to only allow connections from those with valid AD accounts. Is there anything else security wise I should take precautions against? I have never used Win2k3's ftp server and am not entirely sure of the security behind it. I'm pretty sure that its secure (as I have port scanned from the outside and don't see it which is good) but its for a client I'm working with so I'm a little paranoid.

Comments

  • RobertKaucherRobertKaucher Member Posts: 4,299 ■■■■■■■■■■
    YES!!!! Answer these questions:
    * What sort of encryption does FTP use to authenticate (how are passwords sent from client to server)?
    * What does it mean if AD user accounts and passwords are being transmitted in this way?
  • NightShade03NightShade03 Member Posts: 1,383 ■■■■■■■□□□
    When you try to access the FTP server from the outside (aka at home) the only username/password combos that will work is if its an account from active directory.

    I have SSL setup for the FTP server so all encryption LAN or WAN is enencrypted
  • blargoeblargoe Member Posts: 4,174 ■■■■■■■■■□
    When you try to access the FTP server from the outside (aka at home) the only username/password combos that will work is if its an account from active directory.

    I have SSL setup for the FTP server so all encryption LAN or WAN is enencrypted
    No you don't, not for FTP service on IIS for Windows 2003. It doesn't support SSL no way no how.
    IT guy since 12/00

    Recent: 11/2019 - RHCSA (RHEL 7); 2/2019 - Updated VCP to 6.5 (just a few days before VMware discontinued the re-cert policy...)
    Working on: RHCE/Ansible
    Future: Probably continued Red Hat Immersion, Possibly VCAP Design, or maybe a completely different path. Depends on job demands...
  • NightShade03NightShade03 Member Posts: 1,383 ■■■■■■■□□□
    blargoe wrote: »
    No you don't, not for FTP service on IIS for Windows 2003. It doesn't support SSL no way no how.


    Really?! One of the guide in Microsoft's documentation says it does lol, but seriously that doesn't mean anything because I don't trust Microsoft anyway...

    I'm still testing so I guess I should make sure there is some encryption there huh?
  • qwertyiopqwertyiop Member Posts: 725 ■■■□□□□□□□
    Really?! One of the guide in Microsoft's documentation says it does lol, but seriously that doesn't mean anything because I don't trust Microsoft anyway...

    I'm still testing so I guess I should make sure there is some encryption there huh?

    To my knowledge only Windows Server 2008 has the ability to use SSL with FTP.

    If your able to get it running on a 2003 box then let us know
Sign In or Register to comment.