ftp server location 1

[mudddawg]

I am trying to find the best place to locate my ftp server. Currently our network sits behind a firewall, as well as the ftp server, with the ftp ports open on the firewall to the server. To me this seems to be a huge security risk. But for the network users this is ideal because the ftp files are easily accessible.

If I move the ftp server to the outside of the firewall, I feel that I might be in for some trouble with that server as it will be wide open. As well as making it somewhat more difficult on my users getting their files.

With the many ftp servers out there, I am sure there must be some solution to this problem.

Thanks in advance for your help.

 

[bjverzal]

I would venture to say that the way it is configured right now, is probably the way most people have it set up.

Bill.

 

[pmkincaid]

Having a publically accessible server behind your firewall is a definate problem. Think about this, if you have your FTP Server on the outside and someone breaks into it, that is bad, but they only have access to that one server. If your FTP Server is broken into on the inside, they now have complete access to you internal network, VERY BAD!!!

True, having the server on the outside is going to open it up more, but there are ways of protecting it. Shutdown every service you do not need on the server (ie absolutely no telnet - use SSH if you need remote console access, turn off HTTP servers, Ident, mail, etc, etc, etc). Basically, lock it down tight, so the only thing that is open is FTP - which you already have open through the firewall, so you are really not opening up anything new.

Also, you could think about adding another NIC to your firewall and hang the DMZ off of that, where you can still have some firewall blockage, but you can still limit where the FTP server can go.

Since your inside people need access to the FTP server, having it on the outside is no problem (its the same as them going to any other FTP server in the world).

In my opinion, having the FTP server on the inside is a very bad idea, if it gets hacked, your whole network is now compromised. If it is hacked on the outside (which you need to lock down the server anyway), you can minimize the damage that can be done to your entire network.

Hope this helps,
Paul

 

[aduplicate]

I agree with paul, any service you want to run out on the net should be put in a DMZ, all rules on your fw should block unwanted access to your DMZ servers.

 

[wushutwist]

You could also tunnel your FTP traffic through SSH to avoid the security holes inherent in FTP. This would require a bit more configuration on the client-side but would definitely raise the overall level of security on that box. Wushutwist