FTP/TFTP enabled on server?

[heathersuzanne]

Hi everyone,

I'm in a training class now, and my teacher told me that we should NEVER enable FTP or TFTP on the 8xxx servers - that its some sort of security issue. All my 8300'd have it enabled - n fact we are using the ftp on the server itself for phone registration. My teacher tried to expailn why this was wrong but I just dont get it - why is that so bad? Something about opening port 23 to the world...?? Any clues? How worried should I be about my systems set up this way? Thanks!!!

 

[MaxEMEA]

I think your teacher is confused with 'Telnet'. Telnet uses port 23 and is not secure and anything you type can be seen in a sniffer trace. Ie, password's etc.

In CM4 telnet is disabled by default and you must SSH to CM.

It's ok to use the S8300 as a TFTP server for upgrades.

 

[heathersuzanne]

Whew! Thanks!!!

 

[sjforcum]

As long as you're not going over 100 phones at a site, you should be fine using the S-8xxx as the TFTP / HTTPS server for your phone firmware needs.

 

[heathersuzanne]

what happens after 100?

 

[simreal]

You teacher is correct. You can use the TFTP/FTP funcion of the SXXX server but it does create a security risk.

The SXXX server is a linux server. TFTP/FTP are the largest security risks for linux in general and it has nothing to do with the fact that its an avay product.

If your network is secure then you may not even have to worry about it but if you aren't sure I would do a little research.


you can google "linux ftp security" and find plenty of information on this issue. With most linux devices there are things you can do to close up the holes in security even while enableing ftp/tftp services. However, because this is an avaya product, you are not allowed to make said changes to the system without voiding your warranty.

The best solution is to simply use an external FTP/TFTP server.

 

[mrjedi]

if you want to enable ftp services on the server, try: sudo ftpserv on.

This command allows you temp access to server fo downloading patches..

 

[telcoguy]

Just for the fun of it, when you return from class start a sniffer like wireshark on the same LAN segment, start an FTP session, and you know why.
FTP, and TFTP send their passwords over the network 'plain-text'.In other words: anyone doing that can get access to your systems.
Port 23 is telnet, same thing...
SSH usually is a good replacement for telnet, as this is more secure.