Re: remove users from ftp site


"cmyar" <cmyar@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:2D53DB9E-59ED-497C-A9EF-0B98D422A9CC@xxxxxxxxxxxxxxxx
no i can't log in with the administrator account. it still concerns me
that
the administrator account and the anonymous user are accepted users


Ok, well you are misunderstanding the issue then.

Rejecting Users = bleeding data to an attacker. Telling them "Yes exists,
or No does not exist". If you get any kind of auditing, you will get dinged
for that as it opens you up to all sorts of social engineering attacks as
well as a focused brute force attack on the existing accounts. A single
variable isolated (the username) makes the problem to a "couple of months"
problem from a "longer than the universe has existed" problem.

Not rejecting users = giving them _nothing_ to start getting a foothold on.

You are thinking the first one is safer than the second one, which is
incorrect. The server should simply fail to login in _exactly_the_same_way_
no matter what it is that is wrong. Anything else, and you are giving away
information you don't want out there. You deleted the administration
account, now why do you want to ADVERTISE that fact?


.

Relevant Pages