The third section provides information about previous CERT advisories related to FTP services. The following guidelines are a set of suggested recommendations that have been beneficial to many sites. CERT recognizes that there will be sites that have unique requirements and needs, and that these sites may choose to implement different configurations. Configuring anonymous FTP FTP daemon Sites should ensure that they are using the most recent version of their FTP daemon. This is a common configuration problem.
Many sites find it acceptable to use the root account.
Making the ftp root directory and its subdirectories owned by root, part of the system group, and protected so that only root has write permission will help to keep your anonymous FTP service secure. These files are optional and are not used for access control. These files should be owned by root. The dir command uses these dummy versions to show owner and group names of the files and directories instead of displaying arbitrary numbers. These files should include only those entries that are relevant to the FTP hierarchy or needed to show owner and group names.