Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

368

|

Chapter 11: Securing File Services

My final general guideline for anonymous FTP is not to allow anonymous uploads

unless you know exactly what you’re doing, and if you do, to configure and moni-

tor such directories very carefully. According to CERT, publicly writable FTP

directories are a common avenue of abuse (e.g., for sharing pornography and

pirated software) and even for Denial of Service attacks (e.g., by filling up disk

volumes).

If you decide to create such an FTP drop-off directory (conventionally named incom-

ing), there are a number of things you can do to make it harder to abuse:

• As with the FTP chroot jail itself, make sure the writable directory isn’t owned

by the anonymous user account.

• Enable public write access (i.e., the FTP command STOR), but disable public

read access (i.e., the FTP command RETR) to the writable directory. This pre-

vents uploaded files from being downloaded by other anonymous users. Public

execute access, which allows users to change their working directory to incom-

ing/, is okay.

• To prevent Denial of Service attacks that attempt to stop the FTP server by fill-

ing its filesystems, consider limiting the maximum uploadable file size, setting

the anonymous FTP user account’s disk quota, or mounting the writable direc-

tory to its own disk ...