Re: Transfer files open shares vs ftp

From: Bronek Kozicki (brok@rubikon.pl)
Date: 03/04/02 

From: "Bronek Kozicki" <brok@rubikon.pl>
To: "pen test" <pentestlist@hotmail.com>, <focus-ms@securityfocus.com>
Date: Mon, 4 Mar 2002 21:20:15 +0100

> Feedback on shares vs ftp is appreciated.

Shares give you much wider access than writing to the file system alone.
That's why you should avoid them, and prefer other methods where only file
system is accessible. You may enforce encryption in following ways:
- use HTTP PUT, and NTLM authentication (rather poor encryption, but should
be sufficient in LAN)
- use HTTP PUT, and require SSL on virtual catalog / site where developers
have write access to.
- use HTTP PUT or FTP, access only from selected IPs, and configure these
IPs in VPN or IPSec.

I DO NOT encourage you to use Front Page extension - its almost useless and
dangerous gadget. If you consider HTTP variant, simple grant write access to
virtual directory for your developers (+ auth. requirement +some reasonable
ACL +other restrictions). Of course, production should serve these files
from different site !

Regards

B.

Relevant Pages

  • Re: why use ftp if http provides the same services???
    ... >> when downloading a file often the websites give two option..either ... >> download it from a ftp site or http.. ... >> html.eg.word,spreadsheet file) from http server and ftp server.? ...
    (comp.lang.java.programmer)
  • Re: Overview Of New Intel Core i7(Nehalem) Processor
    ... FTP wins on all counts. ... Check the RFCs. ... HTTP, thus the need for a downloader tool to replace much of the ... Most HTTP download managers are a scam; if you fell for it, ...
    (sci.electronics.design)
  • RE: Size checking?
    ... > of OOP. ... >> way to go at least for the HTTP files. ... >> won't) provide the same file via FTP, ... >> protocols to their common factors. ...
    (perl.beginners)
  • Re: Opentextfile TriStateMixed
    ... If it doesn't work you might also try using HTTP. ... I find that if I use winsock and talk directly to an FTP server, ... The FTP server just sends the file to me with an HTTP ... "The GetHeader method is used to retrieve header text from an HTTP file" ...
    (microsoft.public.vb.general.discussion)
  • Re: Questions on secure remote access to Fedora Core 2
    ... After most of a day of research on iptables, and a bunch of trial and ... Keep HTTP and HTTPS open for everybody ... Open inbound SSH, FTP, and mail for everybody ... ... users who for whatever reason can't use SFTP. ...
    (comp.os.linux.security)