Signature to prohibit delete of files/folders on ftp server

[Jhun Banzuela]

Hi,

Is there a signature that can detect ( and prohibit) delete action of files and folders on ftp server.

If none, is there a way to create customized signature?

we want our ftp server to allow only download and upload files and delete is not allowed from external network even they have privilege.

Regards,

Jhun

[rhermes]

It would be possible to create a TCP session signature that would trigger on the string "del" or "rm" with the destination IP address of your FTP server, but those text strings could appear in other traffic you may not want blocked.

The more reasonable way to accomplish this goal is to edit the user accounts on the FTP server to allow or deny the permissions you want the users to have. That way a privileged account could still manage your FTP server and perform all ftp functions.

- Bob

[Jhun Banzuela]

Thanks for the reply Bob.

We normally do all other tasks from internal network. From external network, we only allow download and upload.

So blocking delete from outside may be considered.