FileZilla Server¶
FileZilla Server is a common third-party FTP server on Windows. Plain FTP sends passwords in clear text, so the job is to force encryption, limit accounts, and stop brute-forcing.
Manage it¶
The FileZilla Server administration app (Start menu). Settings are also in C:\ProgramData\filezilla-server\settings.xml; users are in users.xml. The GUI is easier; the files are for verifying.
The settings¶
| Where | Setting | Why |
|---|---|---|
| Server → Configure → Protocols → FTP and FTP over TLS | Minimum allowed TLS version: 1.2 (or 1.3). Tick Require TLS. | TLS 1.0 and 1.1 are broken; plain FTP has no encryption at all |
| Server → Configure → Rights management → Users | Only accounts belonging to people who transfer files. Disable or delete the rest. | Every FTP account is a login |
| Each user | Strong password; Enabled only for authorized users | |
| Server → Configure → Logging | Enabled, log to file | Failed logins and transfers are evidence |
| Server → Configure → Updates | Check for updates: enabled | |
| Server → Configure → Autoban | Enabled. Ban after 5 failed logins within a window of at least 1 minute. Ban duration between 1 and 60 minutes. | Stops password guessing against FTP |
| Help → About | Version current | Old versions have known vulnerabilities |
Verify in settings.xml¶
Select-String -Path C:\ProgramData\filezilla-server\settings.xml -Pattern "min_protocol_version|ban_duration|login_failure_time_window|enabled_types|allowed_type|product_version"
min_protocol_version="2"(TLS 1.2) or"3"(TLS 1.3)<ban_duration>between 60000 and 3600000 (milliseconds)<login_failure_time_window>at least 60000- Logging
<enabled_types>not0 - Updates
<allowed_type>not0
And in users.xml, each <user name="..." enabled="true"> should be someone the README authorizes.
The service¶
Get-Service "FileZilla-Server" | Select Status, StartType
Running and Automatic if the README says the machine is an FTP server.
Example¶
users.xml has <user name="anonymous" enabled="true"> and <user name="jet" enabled="true">. The README lists two FTP users, neither of them those. Disable both accounts in the admin app. settings.xml shows min_protocol_version="0"; set it to TLS 1.2 minimum.