Anonymous FTP should not be made available on every host
on the network.
Choose one machine (preferably a server or standalone host) that is protected from your internal
network. This can be the same machine as mail or WWW server. This makes
monitoring for security violations much easier. In the section on
configuring a Internet server, we go into details about securing your ftp
server. Here, I'll just cover some basic issues.
Incoming transfers to this server should be in a separate directory (i.e. incoming). This is the
only directory where the user ftp can write. However, they cannot read
this directory. This is to keep your site from becoming a repository for pornography, pirated
software and other nasty stuff. Check often the contents of the directories into which ftp is
allowed to write. Any suspicious files you find should be deleted.
Although the ftp
directory should not be writable by the ftp user, you should still check for "hidden" directories or
files. Review what is being abused to take appropriate action, based on what your
security policy says. If you can determine where the stuff is coming from,
notify both CERT(Computer Emergency Response Team) and/or that site. If you can't find a phone
number for that site, do not send the system administrator email. If the other
site is compromised, the intruder may check through the email files.