Can I stop executables on my FTP server?

[JBruyet]

Hey all,

I'm getting ready to deploy my FTP server and I've run into what I think is a problem. I have local accounts set up on the server itself for access control, but I just found out that I can FTP an executable file up to the server then run the executable file. I looked at the security tab for that folder on the server and all I had checked for my test account were the "List Folder Contents" and "Read" permissions. Is there a way to stop executable files from being run on my FTP server? This server will only be used by people with legitimate reasons for sending us files (large files) but I'm a little paranoid with stuff like this. I did have a 2k FTP server get hijacked once and I don't want it to happen with this server.

Thanks,

Joe B

 

[TechyMcSe2k]

You could possibly play with NTFS permissions and set one for everyone in the advanced properties/edit/choose files only and DENY execute file. This would make your users copy all files to their computer before they could open any of them though...

But are you saying they are installing FROM your FTP site to their computer or are they somehow actually installing the app/exe located within FTP on to the server itself?

 

[JBruyet]

TechyMcSe2k, actually it was a test I was performing on the ftp server. I ftp'ed a .exe file to the server, tried to execute the file from my ftp client (wsftp), and the file ran. I was told that my previous server was hijacked due to my allowing executable files to be run remotely. While this server will be locked down to local accounts with passwords, I still want to make sure no one can mess with the server because this server will be facing the internet. <humor> I double-checked and while being paranoid isn't an official title in my job description, it is recommended down in the second paragraph.</humor>

Thanks,

Joe B

 

[TechyMcSe2k]

Quote:"actually it was a test I was performing on the ftp server. I ftp'ed a .exe file to the server, tried to execute the file from my ftp client (wsftp), and the file ran", this means it is only running on your machine that you connected from. As far a remote execution, the hacker would need to have gained backdoor access and exploit some vulnerability in your OS. As long as you have a firewall in front of the FTP and the OS is up to date with all patches and such, you should be fine. I would look into putting an ISA server in front of your FTP if you are that worried. Then only allow FTP Traffic.

 

[JBruyet]

TechMcSe2k,

To clarify, are you saying that someone can upload an executable but when they actually execute it the file will only run on their local computer? As to the other stuff, I keep all my servers updated (VMware is amazing for testing updates) and I have a Cisco firewall (ASA5510) in front of everything. My plan is to just forward ports 21 & 22 to my ftp server.

Thanks,

Joe B

 

[TechyMcSe2k]

Yes, it is on the FTP server on in file format. But when a user accesses it from their machine, it is ONLY installing it on their machine and not your FTP server.

 

[allywilson]

There is something to the idea of remote commands being executed over FTP.

I don't have IIS running close at hand to test, but see the following:

http://search400.techtarget.com/tip/0,289483,sid3_gci531740,00.html

 

[TechyMcSe2k]

FTP has always been a touchy subject. Just use firewalls, a DMZ, and a well patched server with a bare minimum foot print. I have yet to test, but I hear Windows 2008 has a "lite" version with no GUI for a small footprint. Makes you learn powershell quickly to configure the server and should host IIS....but this is going down another path.

You could find someone else to host the FTP server to make you sleep at night. But I figure we have all been in IT long enough to know that there is no system 100% unhackable, given enough time and resources.

 

[SteveRoadWarrior]

You may want to see if the Server 2003 lockdown tool has the ability to tighten things up for you. Do this in a test environment first, not on your production server.

Be aware too, that being able to run something from Windows Explorer is different than having it started by a service:

http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/93501.mspx?mfr=true