Re: Turning off the FTP Banner
From: Alun Jones [MS MVP] (alun_at_texis.com)
Date: 06/11/03
- Next message: Scott: "IIS FTP Security"
- Previous message: Jeff Cochran: "Re: Product Key # for certification"
- In reply to: Neil Owens: "Turning off the FTP Banner"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 11 Jun 2003 12:43:30 GMT
In article <O8IjBl5KDHA.2312@TK2MSFTNGP09.phx.gbl>, "Neil Owens"
<neil_o@ntlworld.com> wrote:
>I've looked high and low to try and turn off the IIS5 FTP banner announcing
>my machine name and which version of IIS I'm running.
>
>So, please, how do I turn it off?
Think about what that will gain you. I presume you are trying to protect
against hackers.
Okay, so let's start with a blinding observation or two:
1. Most hackers aiming their tools at FTP sites don't bother to check the
banner, and just fire off the hack-du-jour.
2. Some of them don't even care whether it's FTP or not - they fire off
their favourite exploit of the moment at all open ports on any IP address
they find. Set up a sacrificial FTP server, and you'll find it's hit by
several requests for HTTP proxies.
3. Many graphical FTP clients key off the greeting banner to determine how
they present certain features. Changing the banner would reduce the
usefulness of such a client, and make the user experience less comfortable.
The only answer I've heard to those two points is to suggest that maybe
there's a hacker who is specifically targetting your organisation. Okay,
let's assume that, and we'll come to blinding observation number four:
4. A targetted hacker, who cares what system you're running, can determine
it from any number of sources - the responses given to certain commands, IP
fingerprinting, or even social engineering. He may even be well aware of
what version you're running before the banner even displays. Even so, most
targetted hackers will simply run every known exploit at you, because it's
quicker.
Changing the greeting message is not a significant security protection, in
my view. I hope I've adequately explained above why I believe this.
Alun.
~~~~
- Next message: Scott: "IIS FTP Security"
- Previous message: Jeff Cochran: "Re: Product Key # for certification"
- In reply to: Neil Owens: "Turning off the FTP Banner"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
