theeldergeek Posted May 10, 2011 Posted May 10, 2011 This is a personal matter, not related to work at all. I am currently running an FTP server so that my Dad in Cyprus can log in and 'collect' photos and what have you that we put in the FTP folder on my machine. We found this to be better than email as some of the pictures are quite large in size, particularly recent wedding shots we posted for him and I don't have to resize files to get them under quotas. However, this morning I noticed someone had tried to log into the FTP server - I checked the logs, and they made 'hundreds' of attempts with different usernames and passwords, none of which worked as there is only one account, and that is my Dad's, and his password is of a secure combination anyway. Firstly, I'm wondering how they found the FTP server in the first place, but secondly, and more importantly, is this the best and most secure way for me to get large files to my Dad? I would prefer to not have to upload them to the 'cloud' for him to retrieve them, as that then puts some onus on me to upload them - our present system he can just log in and get them at his leisure. Is there a more secure yet just as direct way to share a folder with him so he can get to my 'stuff', and not too complicated for me to set up or him to understand? Someone mentioned a VPN to me, but I have no idea as to how I could set that up. Or do I need not worry about this drive-by attack? The fact that they couldn't get in hasn't left me entirely happy though. Would appreciate some thoughts.
cpjitservices Posted May 10, 2011 Posted May 10, 2011 could you not use the likes of FlickR and photo bucket ?
Devontechie Posted May 10, 2011 Posted May 10, 2011 You could use Dropbox for it. That way you just need to copy the files into the folder that is shared with your Dad and then they sync with server and download to his machine. Steve
webman Posted May 10, 2011 Posted May 10, 2011 These sorts of random brute-force attacks are fairly common on the internet: usually a program iterates over a set of IP addresses and common service ports, identifies any that are open as a potential method of gaining entry, and will then try many password combinations until they give up, fail, or are blocked. The most simple way to reduce these attacks is to move the FTP server on to a non-standard port, (e.g. 2100, 2121 or something).
theeldergeek Posted May 10, 2011 Author Posted May 10, 2011 could you not use the likes of FlickR and photo bucket ? I currently have a photo library in excess of 85Gb, online services aren't practical for me. FlickR has upload limits, unless I pay. Not sure about the other one, presume there are also some limitations. No, I would prefer to share a folder on my machine, that way I have all the files locally and don't have to worry about uploading them.
theeldergeek Posted May 10, 2011 Author Posted May 10, 2011 You could use Dropbox for it. That way you just need to copy the files into the folder that is shared with your Dad and then they sync with server and download to his machine. Steve Cost is a factor too, I should have mentioned it. I want free, non-cloud where possible, secure. No one can take me down the VPN route?
mac_shinobi Posted May 10, 2011 Posted May 10, 2011 I currently have a photo library in excess of 85Gb, online services aren't practical for me. FlickR has upload limits, unless I pay. Not sure about the other one, presume there are also some limitations. No, I would prefer to share a folder on my machine, that way I have all the files locally and don't have to worry about uploading them. SFTP ? Is it not possible to do this over a VPN ( hamachi ?? ) https://secure.logmein.com/products/hamachi2/download.aspx If not then is it not possible to do FTP or SFTP over SSH ? Think with the free version you have to use un-managed otherwise I think you have to pay for the managed version ??
Arthur Posted May 10, 2011 Posted May 10, 2011 Three more (non-cloud) options... FreeFTPd - A free FTP server which supports SFTP and FTPS. Windows Live Mesh - Like DropBox, but lets you sync more than 2GBs worth of data between computers for free. HTTP File Server
tom_newton Posted May 10, 2011 Posted May 10, 2011 FTP is inherently insecure, but this has to be taken with a few caveats... the reason it is insecure is that user credentials are generally transmitted in the clear. This is exploited by sniffing packets along the network route between user (your dad) and ftp server. Obviously this hasn't happened - if they had sniffed a password they would not be brute forcing. As such, there's no "problem" with insecure FTP as long as you are vigilant (it seems you are) and your dad keeps his machine looked after (some viruses install keyloggers that look for ftp creds). Easy Suggestions: Back up the photos - if someone does break in, they are more likely to add than remove, but this wont hurt Make sure no accounts are enabled with "standard" names like root, anonymous, guest Make sure your dad's password is better than trivially complex Slightly harder suggestions, depending on your FTP server SecureFTP (doesn't mitigate this issue, may help others, less likely to ) Block all IPs not in the netblock of your Dad's ISP (assume he's on a dynamic IP) Use a nonstandard port (yick, makes your dad have to work something... if hes anything like my dad, thats a non-starter) Check his password with John The Ripper Use something like denyhosts (is denyhosts ssh only...? meh..) Use SSH/SCP - would require him to use winscp Run the ftp daemon in a chroot jail to protect the rest of your server Dont show the welcome banner until after user auth 2
dhicks Posted May 10, 2011 Posted May 10, 2011 Firstly, I'm wondering how they found the FTP server in the first place They scanned your IP address and FTP's port number. Is there a more secure yet just as direct way to share a folder with him SFTP? Just install an SSH server on your machine (it does work on Windows too) and find an SFTP client for your Dad to use. 1
cpjitservices Posted May 10, 2011 Posted May 10, 2011 Team Viewer lets you remote access a Pc it's free and simple to set up and it even has file transfer which is pretty neat!
tom_newton Posted May 10, 2011 Posted May 10, 2011 Mr hicks is right (sorry, meant to answer that too... one of those "at work" posts where i get interrupted 6-8 times during writing)... this will have been a random portscan looking for something to attack. What malware types want is an ftp site to which they can upload stuff that will be served on the web. This isn't because they cant afford their own bandwidth, but to leverage "url trust" somewhere else - say they manage to put malware payload on a company's website, they can reliably hope that won't be blocked by "dumb" url filters and it might get plenty of passing visitors to infect. They'll pick a block of IPs, and scan for services, sometimes selling IP:service lists to others who then do the attack, sometimes they do the attack themselves. You are more likely to be attacked if you have a dns entry, or you're on a static IP as these are decently indicitave of value. Just to re-iterate earlier advice... FTP probably _is_ the tool for the job (especially if a break in would be quickly noticed and little harm could be done as you are backed up) - online services will prove costly for your data volumes, and vpn is overkill (especially if your dad is not uber-savvy). The only options i'd table if you're concerned are scp and sftp, but neither of these directly mitigate brute force attacks like the one seen - though pubkey ssh auth does, it is again subject to marginal setup overhead. Oh.. and you could make your ftp directory readonly. That sounds like "a plan". Best of luck
dhicks Posted May 11, 2011 Posted May 11, 2011 this will have been a random portscan looking for something to attack Although, I did think it might be a copyright-scanning tool from a record company or similar?
tom_newton Posted May 11, 2011 Posted May 11, 2011 Although, I did think it might be a copyright-scanning tool from a record company or similar? Hm, they do sell CDs still, maybe they are out of touch enough to think that pirates use a technology from 1971 to rip off their starving artistes..
localzuk Posted May 11, 2011 Posted May 11, 2011 Personally, I'd do this by setting up a web server, and enabling webdav, ssl and authentication. Hm, they do sell CDs still, maybe they are out of touch enough to think that pirates use a technology from 1971 to rip off their starving artistes.. They use IRC and NNTP servers to do it, so why not FTP? 1
Marci Posted May 11, 2011 Posted May 11, 2011 Copyright-investigators would find themselves in severely hot water if they were attempting to bruteforce auth into a server of any type. Scanning IRC / NNTP / Twitter etc is fine - that info is generally open to viewing, or users can specifically sign up to view, but attempting to bruteforce a system is as serious breach of the Computers Misuse as piracy in the first place.
tom_newton Posted May 11, 2011 Posted May 11, 2011 Personally, I'd do this by setting up a web server, and enabling webdav, ssl and authentication. Best alternative yet IMHO.
edutech4schools Posted May 11, 2011 Posted May 11, 2011 some ftp servers have the option to block an ip if the wrong password is entered x times. Another angle would be to install Gallery2 or 3 Gallery | Your photos on your website on your machine at home and display the pics / vids in your own website. Gallery is free, has been around for years and is fantastic. Gallery 3 took me 4 mins to setup and you can point it to a directory on your system to display the pics from. Enable the download full size module so your dad can batch download any photos in a zip file.
dhicks Posted May 20, 2011 Posted May 20, 2011 These sorts of random brute-force attacks are fairly common on the internet Just came accross this on Slashdot: Ask Slashdot: FTP Server Honeypots? - Slashdot
JWaite Posted May 23, 2011 Posted May 23, 2011 I think I can shed some light on whats happening. They will start by using a free app like 'Ping Range' from softpedia and leave the app running on a range of ip's pinging each one on port 21, making a list of the ones that reply. These IP's will then be attacked by brute force attempts to gain access. Why ? Once they get access, they create a structure of hidden folders (to windows) and store porn, movies, whatever on your ftp server. They will then post the details on a forum for other members to download. This was rampant when server 2003 was released, since installing the IIs component for a intranet or webserver also installed a ftp with default admin user/pass. And those guys usually had good speed and plenty of storage. Easiest way to stop all this is to change port, block pings and never use a account with the username 'administrator' or 'admin'. And check your logs often 1
mac_shinobi Posted May 24, 2011 Posted May 24, 2011 Best alternative yet IMHO. Is apache any better or i presume u would still need to do a similar config??
localzuk Posted May 24, 2011 Posted May 24, 2011 Is apache any better or i presume u would still need to do a similar config?? Apache doesn't include an FTP server, just HTTP.
bobnewbie Posted June 6, 2011 Posted June 6, 2011 not sure if this would be appropriate, however I am a long term user of livedrive.com/?tid=PC8KVD3P It is an unlimited backup solution that would give you all the features that you are after for about £5 per month. it works by installing their software package on your pc, you can then select the folder/folders that you wish to monitor, and it will in the background back up all the files onto their servers, there is no interaction required by yourself. you can then give your dad the email address and password to the account and anything that is stored in the folder that you have marked is backed up safely to the web portal for him to view and download as he wishes. Sorry if this is not what you want but I have been very pleased with it myself and it is also a lot more secure than opening up ports to your computer. it also backs up all your files securely without you having to worry if the hard drive on your computer dies. Thanks Philip
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now