Category: BPFTP Server

FAQ: BulletProof FTP Server 2010 (Common Questions)

In an effort to help answer some common-questions regarding the latest release of BulletProof FTP Server 2010, we’ve started this blog posting and will update it as new questions are addressed.

Q) How do I make sure I have the most recent version?
A) Great question and I’m glad you asked, because we’ve been making some big improvements! The current version of the software is listed on our website and can be found next to the Windows icon. You can compare this version by clicking on the “About” button and looking at the line saying “Engine: 2010.1.99.99”. Upgrading to the latest version, is easy and just involves download/installing the software from this link:
http://www.bpftpserver.com/products/bpftpserver/windows/download

Q) How do I migrate from BulletProof FTP Server v2.x (aka “Classic”) to BulletProof FTP Server 2010?
A) In an effort to minimize impact during upgrades, we’ve maintained compatibility with the previous configuration files. Migrating to the latest version is easy and just requires copying the files from the previous installation-directory to the new installation-directory and renaming the files.

OLD-NAME => NEW-NAME
USERS.INI => bpftpserver-users.ini
GROUPS.INI => bpftpserver-groups.ini
FTPSRV.INI => bpftpserver.ini

Q) I’ve purchased BulletProof FTP Server v2.x (aka “Classic”), how do I get BulletProof FTP Server 2010?
A) If your purchase is still with the purchase support-entitlement duration (every order included 1-year for free, with the option to increase it to 2 and 3 years), then check your email and spam-folder for the FREE-UPGRADE. It was sent from automated@builtbp.com and contains the subject of “BulletProof FTP Server 2010 for Home (FREE UPGRADE)” or “BulletProof FTP Server 2010 for Corporate (FREE UPGRADE)”.

If you can’t find it or need it again, this information is in your account at our website under the “Members” section and can be accessed online.
http://www.builtbp.com/members

Q) How much is it to upgrade from BulletProof FTP Server v2.x (aka “Classic”) to the latest BulletProof FTP Server 2010?
A) If you have a previous purchase, you can login to the Members section of our website and obtain a coupon-code.
http://www.builtbp.com/members

Q) I can’t “Create an Account”, it says “The information you entered did not match any orders in the system…”!
A) This means that the customer-information you entered did not match any orders in the system. Our system only stores the first 5-digits for US Zipcodes. Make sure you have selected the correct Country. If you still have problems, contact us here:
http://www.builtbp.com/contactus

Q) Nobody can login to BulletProof FTP Server 2010 and it worked perfectly in BulletProof FTP Server v2.x (aka “Classic”)!
A) Find out if login attempts are getting through to BulletProof FTP Server 2010 under Console -> View Server Log. If you try to login and “nothing happens” in the Server Log, then you have something which is firewalling the software from connection attempts, please review this HOW-TO:

http://www.bpftpserver.com/products/bpftpserver/windows/howto/firewall

Q) What’s the difference between the “Corporate and Business” version and the “Home and Non-Profit” version?
A) This is a licensing issue. If the product is to be used in a business-environment with more than 1 employee, then you need to purchase the “Corporate and Business” version. Otherwise, if it’s to be used by just yourself at home or if you are a sole-proprietor, then you can purchase the less-expensive “Home and Non-Profit” version.

Q) Does BulletProof FTP Server 2010 run under Windows Vista, Windows 7, Windows Server 2003/2008?
A) Yes, the System Requirements for the software is listed here:
http://www.bpftpserver.com/products/bpftpserver/windows/requirements

The only niggle about this is Windows System Service support. Microsoft introduced something called “Session 0 Isolation”, which basically means that system-services can not interact with the desktop. Work around is here until the web-interface has been released:
http://www.bpftpserver.com/products/bpftpserver/windows/howto/system/service/support#setup-step08

BPFTP Server 2010 (Update Released)

New Version

Today, BulletProof FTP Server 2010.1.0.42 was released and contains several User-Interface glitches.

Known Issues

For some computers under the “Management” tab, there is a problem with the controls correctly “repainting” themselves when the main-form is sized smaller/bigger. This problem can be resolved by clicking on one of the other tabs, such as “Overview” or “Console” and then back again. We’re working on a fix for this as we speak.

Migrating from BulletProof FTP Server v2.x aka “Classic”

In BulletProof FTP Server 2010, we’ve done our best to make sure that you don’t loose any settings, configuration or User/Groups; to this end, we’ve included an “importer” to automatically upgrade these files to the most recent version. It’s easy and just involves copying the files from the old-location/name into the new-location/name.

FTPSRV.INI => bpftpserver.ini
USERS.INI => bpftpserver-users.ini
GROUPS.INI => bpftpserver-groups.ini

Changelog

The changelog containing a list of fixes can be found here:
http://www.bpftpserver.com/products/bpftpserver/windows/whatsnew

HOW-TO: License and Registration Codes

We’ve published a new HOW-TO for BulletProof FTP Server which details how the license-file is stored on your computer. This license-file, called bpftpserver.txt, contains your license-information in the form of 4 registration-codes which you received with your purchase.

This HOW-TO give specific information on the license-file, how/where it’s stored, what it contains. It also contains common pitfalls for customers which have purchased the software, installed the codes, but still get a message that their copy is still UNREGISTERED.

Click to View:
HOW-TO: License and Registration Codes

IE7 will not download from FTP Server

Starting with Internet Explorer 7 from Microsoft, certain “security” settings were put into place to protect Microsoft Windows users from being able to view certain types of documents stored on a FTP Server. These document types include .DOC, .XLS, .DOCX, .PDF, .DWG, etc…

The interesting thing is that when using IE7 as an FTP Client to download these types of files from BulletProof FTP Server (or any FTP Server), the file will download correctly and will be stored in the user’s temporary directory on the local-os, then; prior, to executing the application which is associated with the document type, some other Microsoft process makes a security-determination on the file and decides to delete the file or not (without prompting the OS-User). This results in an error message to the User, indicating that the file could not be downloaded.

More Information from Microsoft is available at the following KB:
http://support.microsoft.com/kb/910274

PLEASE NOTE
While Microsoft’s Documentation and instructions on implementing the fix is correct, the Windows Registry Key for the fix is INCORRECT. In addition, Windows XP SP3 DOES NOT include a working HOTFIX (as they state).

Incorrect Registry Key
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274

Correct Registry Key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274

Defending Brute-Force Attacks against FTP Server

Attempts at Bruce-Force Logins
Attempts at Bruce-Force Logins

You might have seen it before, tons and tons of login attempts as random users in your installation of BPFTP Server.

This is the result of a brute-force attack against the FTP Server and results in thousands of login-attempts to the ftp-server using common user-name and either default or dictionary based passwords.

The attacker is usually using several computers, from different points in the world against thousands and thousands of computers on the internet. Once a common tcp/ip port (like ftp’s port 21) is identified, it enters a mode of attack in which a connection is made to the ftp-server and the brute-force attack begins.

Kick+BAN Setting under Options
Kick+BAN Setting under Options

In order to combat these types of attacks, we’ve included a feature call Kick + BAN. Turning on this feature (off by default) will automatically detect these types of attacks and help to thrawt the attack by severing the control-connection and adding the attacker’s IP to the banned-ip-list, keeping them from ever connecting again.

The setting can be found by pulling down the menu Setup -> Main -> General and clicking on Options found in the left panel, then look for the checkbox labeled Limit USER / PASS.

We recommend setting the number of attempts to 5 and set the Kick + BAN.

Please Note: The Kick + BAN feature works against common brute-force attacks, where the attacker opens the control-connection and leaves it open for each login attempt made. This is a common method as the amount of time it takes to establish a tcp/ip connection for each attempt is considerably lengthy and would drastically reduce the effectiveness of a brute-force attack if a new connection needed to be made each time.

McAfee Anti-Virus thinks there’s a VIRUS **RESOLVED***

Starting sometime last weekend, McAfee updated their virus definitions and is now erroneously identifying our software as containing a virus. We are working with McAfee to get this fixed and we’re hoping to get it resolved ASAP!

STATUS: RESOLVED!

As of today, Sep 10, 2008, McAfee has been very responsive and resolved the issue with their latest Virus DAT 5380. If you are experiencing a problem, make sure your Anti-Virus is update to date.

PROBLEM DESCRIPTION

The problem seems to manifest itself in two different ways:

1) BPFTPSERVER.EXE is our main executable and in Virus Definition DAT 5379, the file is being misidentified as “potentiallyFalse Trojan“. As of today, Sep 9 2008, we received word back from McAfee that this has been corrected with Virus Definition DAT 5380.

2) BPFTPSERVER-SERVICE.EXE is the executable which manages BPFTP Server while it’s running as a Windows Service. In the current virus definition DAT 5379, this is being misidentified as “G6SERVICE Potentially Unwanted Program”. While we’re not sure why it got labeled as a “potentially unwanted program”, the G6SERVICE piece is because it shares a majority of code with an ancestor of BPFTP Server called G6FTP Server, which was rebranded about 6 years ago. As of today, Sep 10, we’ve configirmed that Virus Definition DAT 5380 fixes the problem.

FIXING THE CORRUPTION CAUSED BY MCAFEE ANTI-VIRUS

Again, we are working with McAfee to get this corrected as soon as possible as it certainly affects us all very much. Please continue to make sure your virus definitions are up-to-date with McAfee, alternatively you can tell it to ignore the installation directory for the software and prevent this problem from ocurring.

If McAfee Anti-Virus has already deleted these files, they can be resurrected by downloading/installing the current version from our website. Before installing the current version, please copy the *.INI files from your installation directory to a safe location and install in the same directory. This will help to ensure that everything goes smoothly with your upgrade.