#1  
Old 11th November 2012, 13:07
manarak manarak is offline
Senior Member
 
Join Date: Apr 2009
Posts: 262
Thanks: 32
Thanked 6 Times in 5 Posts
Default More security for FTP

Many sites are nowadays getting hacked after a trojan spied on the webmaster's passwords for ftp and sends them out to the bad guys.

So I have the following idea for feature requests:

- please provide a "deactivate" button on the ftp accounts list. the effect of the button would be the same as the current delete button, but ISPC would retain the settings and account name, so that the account could be reinstated with one click.

- please provide a "reactivate for duration X" function for FTP accounts.
For example, FTP accounts could be reactivated for 1, 2, 24 hours and then ISPC would automatically deactivate the account again.

- please provide the possibility to specify *PER FTP ACCOUNT* IP addresses and IP ranges that are allowed to access the FTP account.

This is something I would definitely use on my servers!
Reply With Quote
Sponsored Links
  #2  
Old 12th November 2012, 13:05
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,740 Times in 2,575 Posts
Default

I've added this feature request to our bugtracker.
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #3  
Old 12th November 2012, 13:43
manarak manarak is offline
Senior Member
 
Join Date: Apr 2009
Posts: 262
Thanks: 32
Thanked 6 Times in 5 Posts
Default

thank you Falko, I reckon the IP restriction alone would already add a lot to security.
Reply With Quote
  #4  
Old 12th November 2012, 15:44
Ben Ben is offline
Moderator
 
Join Date: Jul 2006
Posts: 1,029
Thanks: 7
Thanked 62 Times in 56 Posts
Default

But isn't it more security by obscurity, as by limiting the activity time the time window for any trojan to spy the password is smaller.
Also if not enforcing this by default, I assume nobody will really take care of this option.
If the user / admin would know about the problem he would more than that make use of:
fail2ban against bruteforce on the server,
forced (or at least configured) ftps (!= sftp),
forced password policy (complexity)
forced password renewal (aging), optionally with time based deactivation.

To assist the admin, ISPConfig could alert on the ftp tab, if some of the above mentioned mitgation options are not in place.

Just as an additional idea on how to assist solving this issue.
Reply With Quote
  #5  
Old 12th November 2012, 16:16
manarak manarak is offline
Senior Member
 
Join Date: Apr 2009
Posts: 262
Thanks: 32
Thanked 6 Times in 5 Posts
Default

Quote:
Originally Posted by Ben View Post
But isn't it more security by obscurity, as by limiting the activity time the time window for any trojan to spy the password is smaller.
Also if not enforcing this by default, I assume nobody will really take care of this option.
If the user / admin would know about the problem he would more than that make use of:
fail2ban against bruteforce on the server,
forced (or at least configured) ftps (!= sftp),
forced password policy (complexity)
forced password renewal (aging), optionally with time based deactivation.

To assist the admin, ISPConfig could alert on the ftp tab, if some of the above mentioned mitgation options are not in place.

Just as an additional idea on how to assist solving this issue.
Actually it is not, because all the cases I saw so far have been caused by the webmaster getting a trojan on his computer which did then mail out the ftp passwords the webmaster had stored in his system.

fail2ban is not going to help, because the bots already have the password.

But I can imagine that reducing the time window will inscrease security, because the bots are very likely to give up after some time if some passwords don't work.

In the meanwhile, virus sweeps will likely detect a problem on the webmaster's computer.

And restricting ftp access to certain IPs and IP ranges (from where the webmaster connects) will help a lot by simply not letting the bots in.
Reply With Quote
  #6  
Old 13th November 2012, 08:06
manarak manarak is offline
Senior Member
 
Join Date: Apr 2009
Posts: 262
Thanks: 32
Thanked 6 Times in 5 Posts
Default

in fact I think the restriction to IPs and IP ranges is the best protection.
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
PHP.ini security vaio Installation/Configuration 1 14th December 2011 12:09
Problem with ispconfig 3 staff007 Installation/Configuration 4 10th October 2011 21:17
disable security constrain in ispconfig 3 control panel to enable the multisites qiubosu Installation/Configuration 3 10th December 2010 23:04
Unable to install ISPConfig bdonecker Installation/Configuration 21 26th May 2009 08:20
SE linux problem when security context is modified raj123 Technical 1 28th June 2006 08:57


All times are GMT +2. The time now is 02:47.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.