[Zope] some confusion on ftp security.

I was just wondering if there is a separate config file for the Medusa FTP server because it alows anonymous logins even when I have used the zope management interface to create a user say fgh who has the rights that would usually be given to the anonymous group. I even defined a matching group fgh and removed all rights from the anonymous group. The advantage is that the user can not see list or download any files but I was just suggesting that the user does not get a login prompt at all in the first place incase this user manages to find some way of exploiting the system.... (or have I missed something) Thanks. Patrick