# FTP password

**URL:** <https://community.zeek.org/t/ftp-password/3833>\
**Category:** Zeek\
**Created:** [September 17, 2015, 6:39am UTC](https://community.zeek.org/t/ftp-password/3833 "2015-09-17T06:39:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![user13](https://avatars.discourse-cdn.com/v4/letter/u/a88e57/32.png) [@user13](https://community.zeek.org/u/user13)\
**Post date:** [September 17, 2015, 6:39am UTC](https://community.zeek.org/t/ftp-password/3833/1 "2015-09-17T06:39:58Z")

</div>

Hi  
I have setup bro 2.3  
did not change any setting but some of ftp.log has password printed out

1442471625.330839 CJtp9r1Ww7Nrjco5H4 x.x.x.x 511 y.y.y.y 561 ftpuser safepc RETR ftp://w.w.w.w/WINDOWS7/64/Setup.dat - 226 Transfer complete. - - - - -

I checked ftp config but “default\_capture\_password = F”

do I have to do something to not capture password ?

Thank you

---

<div class="post-metadata">

**Author:** ![Josh\_Liburdi](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@Josh\_Liburdi](https://community.zeek.org/u/Josh_Liburdi)\
**Post date:** [September 17, 2015, 12:02pm UTC](https://community.zeek.org/t/ftp-password/3833/2 "2015-09-17T12:02:57Z")

</div>

That user value is one of the default values that Bro will always log  
the password for.

const guest\_ids = { "anonymous", "ftp", "ftpuser", "guest" } &redef;

If you redef guest\_ids to be empty, then it shouldn't log any passwords.

Josh

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/ftp-password/3833/3 "2022-05-06T15:43:05Z")

</div>