FTP password

Zeek
1

Hi
I have setup bro 2.3
did not change any setting but some of ftp.log has password printed out

1442471625.330839 CJtp9r1Ww7Nrjco5H4 x.x.x.x 511 y.y.y.y 561 ftpuser safepc RETR ftp://w.w.w.w/WINDOWS7/64/Setup.dat - 226 Transfer complete. - - - - -

I checked ftp config but “default_capture_password = F”

do I have to do something to not capture password ?

Thank you

2

That user value is one of the default values that Bro will always log
the password for.

const guest_ids = { "anonymous", "ftp", "ftpuser", "guest" } &redef;

If you redef guest_ids to be empty, then it shouldn't log any passwords.

Josh