remove users from ftp site -- iis security

cmyar
8/28/2006 7:24:02 AM

no i can't log in with the administrator account. it still concerns me that
the administrator account and the anonymous user are accepted users

[quoted text, click to view]

Funkadyleik Spynwhanker
8/28/2006 2:12:37 PM

Are you actually logging in with the Administrator account?

The FTP service seems to accept connections and not reject for a username,
instead coming up with the default "authentication denied" thing.

I assume that is to prevent the brute force guessing of usernames and is
expected behavior. Likewise for the IP address restriction, it doesn't
disallow for making a connection, but rules out logging in at all.

[quoted text, click to view]

Bernard Cheah [MVP]
8/29/2006 12:00:00 AM

Well, it just like unknown users to the FTP server.
Of coz it will still accept it, but it will not authenticate it
successfully.

You can't prevent someone to knock on your door, right?

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/

[quoted text, click to view]

Funkadyleik Spynwhanker
8/29/2006 4:08:33 PM

[quoted text, click to view]

Ok, well you are misunderstanding the issue then.

Rejecting Users = bleeding data to an attacker. Telling them "Yes exists,
or No does not exist". If you get any kind of auditing, you will get dinged
for that as it opens you up to all sorts of social engineering attacks as
well as a focused brute force attack on the existing accounts. A single
variable isolated (the username) makes the problem to a "couple of months"
problem from a "longer than the universe has existed" problem.

Not rejecting users = giving them _nothing_ to start getting a foothold on.

You are thinking the first one is safer than the second one, which is
incorrect. The server should simply fail to login in _exactly_the_same_way_
no matter what it is that is wrong. Anything else, and you are giving away
information you don't want out there. You deleted the administration
account, now why do you want to ADVERTISE that fact?

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about iis security

iis security : remove users from ftp site