iis ftp:
Hi all,
We have an FTP service residing on a Win2K server behind a firewall/router
on our local LAN. We use this FTP service to send/retrieve files from remote
customer sites over the public Internet. The FTP site requires a login.
Recently we were getting System messages that a "bot" of some sort was
trying to log into the Guest or Administrateur account every second. Of
course we had the Guest account disabled and for some reason the "bot" was
not trying to log into Administrator account. I immediately shut down the
FTP service and then configured the firewall to use a virtual IP that would
send external requests from a higher numbered Port to Port 21 on our FTP
server.
From a remote site I was able to log in, but as soon as the directory
listing was requested, I would get the 500 Invalid PORT Command error. After
some experimentation I found that if I set the Internet Options to Use
Passive FTP, the problem seemed to disappear. In searching for MS
documentation about that error, I did not see that technique mentioned.
There were articles about "ephemeral" communications ports being requested
by the FTP client under certain circumstances leading to the 500 error, but
no clear instructions about how to remedy the problem. Most just mentioned
that it was a problem requiring proper firewall configuation, but no mention
of what that configuration entailed. I would appreciate being pointed to an
article that clearly explains how to run FTP on an alternate Port
configuration without encountering a problem.
Also, is there any way to remove the Administrator account when specifying
that Anonymous login is not ot be used? In IIS manager I see no way of
removing the Administrators group even if I specify a particular login.
Every hacker in the world usually attacks the Administrator account.
My next option is to use a webDAV enabled folder with SSL on our internal
web server instead of FTP, but I am having trouble configuring Certificate
Services on our Win2003 server such that it will generate a certificate for
our Win2K server, which is the default remote access machine. But I guess
that question is for another newsgroup.
Thanks all in advance...
