Attack on FileZilla FTP server detected.
Attack on FileZilla FTP server detected.
Hi, I've got a small FileZilla FTP setup for family members to back up offsite. It's been running reliably for about eight years with minimal use. Recently, I noticed some suspicious traffic attempts that seem to be targeting the server. While it appears nothing has been successfully transmitted, I'm unsure about the next steps. I want to keep access open for new IPs and occasional phone use, so I don't want to restrict it too much. Any advice would be appreciated. Thanks!
It's possible to restrict access to bigger networks rather than individual addresses, such as by whitelisting the networks AT&T lists for internet use. These lists can be accessed via sites like https://bgp.he.net. Just remember, as the previous poster suggested, avoid using FTP without SSL/TLS encryption.
Thank you for your input. Security isn't a top priority here because we only perform weekly backups in various locations. We've managed it successfully for eight years without issues. Obtaining an FTP certificate was challenging, so we didn't pursue it. The ongoing threats persist, but the same commands are repeatedly attempted from over 500 IP addresses, all flagged as unrecognized. SSHFS appears promising and could simplify things for our parents with a mounted drive. We don't reuse passwords across services, using unique 16-character random codes instead. From the attempted commands, it seems they're not targeting passwords directly but aiming to compromise the system or turn it into a bot. This likely explains why blocking one IP instantly triggers 500+ more. I've already blocked 438 IPs globally, and they appear to respond quickly as soon as I do. Next week, I'll explore the mounted drive options further. Appreciate your advice and support!
The FTP port is accessible to anyone, it will be examined, tested and manipulated by various tools worldwide. This is typical for any publicly available service, just keep in mind it may be targeted if an exploit exists for your software version. I wouldn't suggest using FTP due to its lack of security, though this depends on how important it is for the data being transmitted. You should also consider restricting firewall rules by IP address (static) or dynamically by DNS value, and use a service like no-ip to manage a dynamic IP provided by your ISP.