Working fine on latest 1013 release but FTP security issue
Since upgrading to the 1013 firmware my 363N has been rock solid with no more lockups requiring reboots (about 30 days since upgrade). I recently added a new Maxtor 200GB drive to it and have not had any issues. Transfering large video files (2GB) gives about 50MB transfer rates.
In the past I did see an issue with the hard drive 'disappearing' after reboot but it turned out to be a bad drive. I also got rid of the 40 pin IDE cable that came with the 363N and use the 80pin cable (I had to cut it to make it fit in the case) that came with the Maxtor. The major reason I did this was the quality of the 40 pin looked very poor.
But I have had the following FTP security issue:
No matter how I define a ftp account all ftp users still have universal 'read' access to all FTP accounts if they know the folder name.
Here is the Configuration:
Create two drive folders, name one "FTP_PUBLIC" and the other "FTP_PRIVATE"
Create two FTP accounts:
Account 1 named "FTP_PUBLIC" and give it read only access to the "FTP_PUBLIC" folder, do NOT create a password for it
Account 2 named "FTP_PRIVATE" and give it read/write access to the "FTP_PRIVATE" folder and create a password for it
Also create an Anonymous account and give it access to the "FTP_PUBLIC" folder
Now access the ftp folders from Internet Explorer, log in anonymously
For example, if the the drive is named 'STORAGE_2C92"
The ftp client will automatically connect to the FTP_PUBLIC folder with read only access (as expected)
But if the user manually adds the "FTP_PRIVATE" folder to the address (as below)
You will see the contents of the FTP_PRIVATE folder with read only access. This should NOT happen. A user should never be able to access a private, password secured FTP folder, even if the access is read only.
If the user logs into the "FTP_PRIVATE" folder with correct username and password they will have the correct read/write access (as expected).
I was hoping to configure my firewall to allow ftp access to the net but with this issue I'd rather not.
I've emailed Agrosy support with the issue but was wondering if anyone else has seen this?
I also just discovered that ALL folders in the drive can be accessed anonymously, even if a folder is NOT configured as a FTP folder. All you have to do is type in the folder name and path. This means there is no usefull ftp security in the 363n.