Questions[anonymous](server)

Currently I have a setup with a virtual FTP site in IIS 7.5 that requires the following authentication details for the anonymous account:

Host: ftp.mydomain.com
User: ftp.mydomain.com|anonymous
Pass: <none>

I have multiple FTP accounts setup on this same server. I know that this means I need to specify the domain in the username to let IIS know what I need site to authenticate against, but is it possible to make the username only be anonymous? Would I have to create a user by that name in the windows users and groups area to be and specifically link it there?

How I can set a anonymous sftp user ?

I generate the ssh keys pair, set /usr/lib/sftp-server as shell in /etc/password and share the private key (id_rsa) and with this command the users get access

 sftp -oIdentityFile=id_rsa public_sftp@host

is a good idea ?

I'm running Confluence 3.5.13.

I've got SSO authentication against our Active Directory forest working using the NTLMv2 plugin from TechTime.

Users with an active account in Confluence are logged in automatically, and users with no account can browse spaces as anonymous. No problem here.

There is an issue, though, with users who have an account in the Confluence database which has been disabled. Whatever they try to access they get a page which says, "You are not permitted to perform this action".

My question is this: Is it possible to configure Confluence so that a person with a disabled account is able to browse as an anonymous user can?

Deleteing the user's account is not feasible due to references from content they have contributed in the past. They can log out, but as soon as they go to another page the SSO authenticates them again and they're denied access.

I think I need a way to give users with disabled accounts the "Use Confluence" global permission while maintaining their disabled status for other purposes.

I've posted theis question on Atlassian's forums as well, so the race is on for a good answer. ;-)

Every time the anonymous group targets a website, they are able to take it down.. even for large corporates / governments with professional.

I read (basic theory) about dealing with normal DDOS attack, with DDOS protection techniques.

But why do these techniques fail in case of Anonymous group attacks?

Is there any success stories about surviving through a really good organized DDOS attack?

I need a basic FTP server on Linux (CentOS 5.5) without any security measure, since the server and the clients are located on a test LAN, not connected to the rest of the network, which itself uses non-routable IP's behind a NAT firewall with no incoming access to FTP.

Some people recommend Vsftpd over PureFTPd or ProFTPd. No matter what I try, I can't get it to allow an anonymous user (ie. logging as "ftp" or "anonymous" and typing any string as password) to upload a file:

# yum install vsftpd

# mkdir /var/ftp/pub/upload

# cat vsftpd.conf
listen=YES
anonymous_enable=YES
local_enable=YES
write_enable=YES
xferlog_file=YES

#anonymous users are restricted (chrooted) to anon_root
#directory was created by root, hence owned by root.root
anon_root=/var/ftp/pub/incoming
anon_upload_enable=YES
anon_mkdir_write_enable=YES

#chroot_local_user=NO
#chroot_list_enable=YES
#chroot_list_file=/etc/vsftpd.chroot_list
chown_uploads=YES

When I log on from a client, here's what I get:

500 OOPS: cannot change directory:/var/ftp/pub/incoming

I also tried "# chmod 777 /var/ftp/incoming/", but get the same error.

Does someone know how to configure Vsftpd with minimum security?

Thank you.

Edit: SELinux is disabled and here are the file permissions:

# cat /etc/sysconfig/selinux
SELINUX=disabled
SELINUXTYPE=targeted
SETLOCALDEFS=0

# sestatus
SELinux status:                 disabled
# getenforce
Disabled

# grep ftp /etc/passwd
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin

# ll /var/
drwxr-xr-x  4 root root 4096 Mar 14 10:53 ftp

# ll /var/ftp/
drwxrwxrwx 2 ftp ftp 4096 Mar 14 10:53 incoming
drwxr-xr-x 3 ftp ftp 4096 Mar 14 11:29 pub

Edit: latest vsftpd.conf:

listen=YES
local_enable=YES
write_enable=YES
xferlog_file=YES

#anonymous users are restricted (chrooted) to anon_root
anonymous_enable=YES
anon_root=/var/ftp/pub/incoming
anon_upload_enable=YES
anon_mkdir_write_enable=YES

#500 OOPS: bad bool value in config file for: chown_uploads
chown_uploads=YES
chown_username=ftp

Edit: with trailing space removed from "chown_uploads", err 500 is solved, but anonymous still doesn't work:

client> ./ftp server
Connected to server.
220 (vsFTPd 2.0.5)
Name (server:root): ftp
331 Please specify the password.
Password:
500 OOPS: cannot change directory:/var/ftp/pub/incoming
Login failed.
ftp> bye

With user "ftp" listed in /etc/passwd with home directory set to "/var/ftp" and access rights to /var/ftp set to "drwxr-xr-x" and /var/ftp/incoming to "drwxrwxrwx"...could it be due to PAM maybe? I don't find any FTP log file in /var/log to investigate.

Edit: Here's a working configuration to let ftp/anonymous connect and upload files to /var/ftp:

listen=YES
anonymous_enable=YES
write_enable=YES
anon_upload_enable=YES
anon_mkdir_write_enable=YES