FTP server banner name not changing

[TheDyun]

Hello,

I am trying to display my own custom FTP server name but I keep getting "vsftpd (before 2.0.8) or WU-FTPD" when I nmap it. I suspect it has something to do with my native ftp settings on my kali machine that is conflicting with the opencanary.conf file. Here are my .conf settings for FTP

"ftp.enabled": true, "ftp.port": 21, "ftp.banner": "FileZilla 2.3.31",

[jayjb]

Hi @TheDyun,

Thanks for reporting this issue. Can you paste the first few lines that opencanary shows when you start it?

[TheDyun]

Hello Jay!

Thank you for getting back to me. Here are the first few lines. I am running on opencanary on docker with this command:

docker run --rm --detach -p 21:21 -p 22:22 -v "/home/dyun/honeypot/opencanary/data/linux.conf":"/root/.opencanary.conf" --name linuxhoney opencanary

The services themselves do come alive, and I can manipulate SSH banner, but not FTP banner.

/usr/local/lib/python3.10/site-packages/twisted/conch/ssh/transport.py:97: CryptographyDeprecationWarning: Blowfish has been deprecated

b"blowfish-cbc": (algorithms.Blowfish, 16, modes.CBC),

/usr/local/lib/python3.10/site-packages/twisted/conch/ssh/transport.py:101: CryptographyDeprecationWarning: CAST5 has been deprecated

b"cast128-cbc": (algorithms.CAST5, 16, modes.CBC),

/usr/local/lib/python3.10/site-packages/twisted/conch/ssh/transport.py:106: CryptographyDeprecationWarning: Blowfish has been deprecated

b"blowfish-ctr": (algorithms.Blowfish, 16, modes.CTR),

/usr/local/lib/python3.10/site-packages/twisted/conch/ssh/transport.py:107: CryptographyDeprecationWarning: CAST5 has been deprecated

b"cast128-ctr": (algorithms.CAST5, 16, modes.CTR),

We hope you enjoy using OpenCanary. For more open source Canary goodness, head over to canarytokens.org.

[-] Failed to open opencanary.conf for reading ([Errno 2] No such file or directory: 'opencanary.conf')

[-] Using config file: /root/.opencanary.conf

On Fri, Apr 5, 2024 at 11:10 AM Jay @.***> wrote:

Hi @TheDyun https://github.com/TheDyun,

Thanks for reporting this issue. Can you paste the first few lines that opencanary shows when you start it?

— Reply to this email directly, view it on GitHub https://github.com/thinkst/opencanary/issues/352#issuecomment-2040363851, or unsubscribe https://github.com/notifications/unsubscribe-auth/AZUMP6YW2IUADAQJFVU656LY33SJNAVCNFSM6AAAAABFR42DUSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANBQGM3DGOBVGE . You are receiving this because you were mentioned.Message ID: @.***>

--

David Sungmin Yun Penetration Tester | Taekwondo Master @.*** | 562-282-8544 https://www.linkedin.com/in/david-sungmin-yun/

[jayjb]

Thanks for the information @TheDyun.

Can you confirm that if you

% nc 127.0.0.1 21

from the box running the opencanary; that you see the expected banner?

[github-actions[bot]]

This issue is stale because it has been open for 14 days with no activity.

[github-actions[bot]]

This issue was closed because it has been inactive for 14 days since being marked as stale.