Apache :: Security - Apache opening entire PC to www via localhost

hugeness · Joined: 05 Mar 2015 Posts: 3

Hi

I've just been trying to test a site on on a localhost. When I setup my site via Filezilla, I see I can access all my files on my entire PC with username/password combination via localhost.

Isn't this a huge security risk? Is there a standard way to lock this down?

I was under the impression localhost restricted access to the www folder so pretty concerned.

Thanks

covener · Joined: 23 Nov 2008 Posts: 59

What makes you think filezilla is talking to Apache?

hugeness · Joined: 05 Mar 2015 Posts: 3

I thought that Apache opened up ftp/sftp ports so that localhost could be reached.

covener · Joined: 23 Nov 2008 Posts: 59

Anaksunaman · Joined: 19 Dec 2013 Posts: 54

While it is possible to have Apache handle FTP with something like mod_ftp - https://httpd.apache.org/mod_ftp/en/ftp/ - this is a non-standard module and is not distributed with the base-version of Apache.

At a guess, you likely have an FTP service on your system that is configured with less-than-desirable settings.

Things to investigate could be FileZilla itself (there is the client and a server, though they are separately installed programs) or it might have been as part of another package (WAMP or XAMPP perhaps?).

Jan-E · Joined: 09 Mar 2012 Posts: 1266 Location: Amsterdam, NL, EU

Try 'netstat -anb' in a command prompt (run as administator) to see which program is listening to port 21 and/or 22.