FTP Server Offers Key to the Store

Computerworld - This week I was sidetracked from my projects yet again by the need to investigate two security incidents. Both involved deleted files on servers that apparently had been compromised.
The first incident was more of a server configuration issue than a traditional security incident, but it still warranted my attention. It started when a customer sent a message addressed to our abuse e-mail alias saying that he noticed several suspicious files on our public file transfer protocol (FTP) server. So I logged into the server as an anonymous user, and sure enough, several directories had been created and populated with 4GB of unauthorized MP3 music files.
Even more alarming, I found a file named Commands that contained account names and associated passwords for support Web sites we use and for accessing internal servers in my company.
The special accounts that give us access to technical support Web sites require user IDs and passwords for access. We pay tens of thousands of dollars per year for some of those accounts. It turns out that our product support group put the file there as a repository for what it considered shared, nonsensitive information. Later, it apparently became a repository for all sorts of information.
Unfortunately, we can't just make the anonymous FTP server go away. It's a valuable customer service, and our technical support team uses it extensively to offer patches and other support programs to our users. Our customers also use it to upload event logs and dump files for review by our technical support team. There are other methods for offering this type of service, but the anonymous FTP server has been the most effective and has been accepted by our staff and customers. So it's here to stay. But if it isn't configured properly, an anonymous FTP server can be easily abused and become a catalyst for legal, performance and security issues.
The MP3 files are one such legal issue, since they probably violate copyright laws and an investigation could embarrass our company. Performance would also suffer if the FTP server was saturated with such files, or if too many users accessed the system simultaneously to try to download the files. And we don't want third parties logging into our servers or support services.
Our FTP server had been configured to let anonymous users create their own directories, with no limits on the size of uploaded files. Simple upload quotas and directory permissions would have prevented this incident from happening. I'm going to add guidelines for configuring the anonymous