This is just a general question, I'm not asking for a "How To" guide or anything like that. I run a website and I have been known to host files on the FTP for a very small group of people. In the near future, I'll be uploading some files that I want to restrict the access to (only legitimate users can access).

So my question is, if I disable anonymous users, is it possible for someone to download the file through my FTP without a username and password? If so, I will hold off on uploading until I find something more secure. If brute force is the only way they can access it, I may take my chances.


Again, I'm not looking for answers such as "Yes you could do it by ____ and ____." It's basically a yes or no question.

Also, make sure the ftp server you use doesn't have any known exploits. Search exploit-db.com, securityfocus.com, packetstorm.com and google.

Or to have real fun look up how to do FTP + two factor authentication. Of curse I'd prefer seeing more people using either SFTP (SSH based) or FTPS (SSL based).

Mainly running ftp without some form of security is going to leak the usernames and passwords all over the net.

I'd recommend that instead of just setting them up with a user and password, because they may not be technologically savvy, that he should create an installer / script that sets everything up for them 

It wouldn't take that long, but using unique keys could be a bit problematic to automate (if there's many users), though not impossible (but if you do, make damn sure you do it in a secure way hehe  )

Do NOT forget to disable usage of the SSH shell / terminal (except SFTP) functionality in case you go with this, because if a user is compromised, these credentials could be used to log into an interactive terminal, where remote code execution on the server would be possible.

If they do need (SSH) terminal access, I suggest they of course run with least privileges possible and are not able to sudo unless there is a good reason. Perhaps even jail the users to their own directory without the possibility of symlinking out of there 

Just a few good advises you could perhaps use, it's up to you in the end of course