Why is my website set to 'Allow anonymous access to ftp'?

[Rightz]

Just looking round the control panel of my new domain and found a ticked box next to the option of:

Allow anonymous access to ftp://ftp.mydomain.com

Does this mean anyone could change any part of my site? Or in fact delete the entire site?

Ive un checked this now - is this the right thing to do?

[Stefan]

People would have only had access to the ftp folder, not the www. It sounds like your server config came with the anonymous ftp access enabled - that's surprising. Anyway, you've unticked it, and that's taken care of, so no worries (but check the folder and make sure it's clean). You definitely don't want anonymous access to the ftp section, or people could load it down with all sorts of garbage, and use your server as a transfer station.

That said, password controlled ftp can be a wonderful thing for an organisation or group, as long as you're careful about who has access. It's a great way to shunt large files around.

[jtara]

It's hard to answer this without specifics. What control panel? What FTP software?

That said, this may not be as bad as it sounds, and is a common default setup.

"anonymous access" simply means that the server will allow logins using the the user ID "anonymous" and any password.

Typically, the server will have additional access controls restricting the directory and access type for the anonymous user ID. Typically, this would be read-only access to the FTP folder and subfolders.

This is consistent with the original intent and common usage of FTP.

If you want to use FTP to provide file downloads to anyone, without requiring them to have a user ID, this is the only way to do it!

If you are only using FTP to maintain your website (to upload web pages) then, frankly, you should NOT be using FTP. FTP is insecure. Passwords (as well as files) pass over the network unencrypted.

You should be using SFTP, which comes with SSH. Many modern FTP clients provide support for SFTP, as well as most SSH clients. With SFTP, both data and passwords are encrypted over the network.

[Rightz]

Thanks for the advice guys. I couldn't figure out why there were so many more logins by anonymous users than by myself. By control panel - I mean the area my domain host let me use to configure my website controls.

Anyway glad that is turned off now!

[jtara]

By control panel - I mean the area my domain host let me use to configure my website controls.

What I meant when I asked "what control panel?" is that your control panel!= my control panel.

There are a lot of different control panels. Plesk? cPanel? Helm? DirectAdmin? They're all different.

Sorry, it's a pet peave. "I've got a standard website. Can you help me configure it?"

What's a standard website?

[Rightz]

Ahhhh sorry for being ignorant ;)

It's cpanel