Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Focus-Microsoft
[Top] [All Lists]

RE: FTP on IIS

Subject: RE: FTP on IIS
Date: Fri, 18 Jan 2008 17:10:14 -0500
Hi Lauren,

The very nature of FTP is insecure because the passwords used for
authentication are sent in the clear.  Your best bet would be to use
some type of third-party FTP server/daemon that allows you to use FTP
over SSL.  Currently IIS (v5.0 and 6.0) does not support this natively.
If you are stuck with IIS, then you could only allow FTP access via a
VPN. From there you can lock the site directories down using NTFS
permissions  All in all there isn't a whole lot IIS can do natively to
"secure" an FTP site.

Just my $.02

Ryan
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of lauren.malhoit@tylertech.com
Sent: Friday, January 18, 2008 1:58 PM
To: focus-ms@securityfocus.com
Subject: FTP on IIS

I'm preparing to build a new FTP server using IIS (or an IIS server
using FTP???  I'm not sure).  Anyway, I was wondering if anyone could
recommend some good sources on how to lock it down.  I need to configure
it for an FTP site that anyone can get to and one that is password
protected.  Thanks in advance!

<Prev in Thread] Current Thread [Next in Thread>