Anonymous FTP and bounce attacks

Anonymous FTP can publish public downloads without individual accounts. It should expose only intended directories and should not combine public uploads with public execution or downloads carelessly.

The classic FTP bounce attack abuses PORT to make a server open a data connection to another host and port. Servers should restrict data endpoints and avoid connecting to unrelated addresses or privileged ports.

Old protocols accumulate security lessons in later RFCs. Reading RFC 959 alone is not enough to deploy FTP safely.

Anonymous access is still an account and policy boundary. Give it a fixed root, read-only access to intended public files, rate limits, logging, and no access to secrets or executable server paths.

If anonymous uploads are unavoidable, separate upload and download directories. Use server-generated names, quotas, scanning, and a review step before publication. Otherwise the service can become public file hosting or a malware exchange.

A bounce attempt asks the FTP server to connect somewhere chosen by the client:

C: PORT 198,51,100,20,0,25

That encodes port 25 on another host. A safe server rejects endpoints that do not match the control client’s address and blocks privileged or otherwise unsafe destinations.

Passive mode reduces this specific direction of abuse because the client connects to the server. It does not make anonymous uploads safe by itself.

Review a test server’s anonymous root and active-mode policy. Prove that an anonymous user cannot upload executable content or make the server connect to an unrelated address.