Re: Mitigate FTP



if you use ssh (server) with scp (in clients) using cryptographic key
authentication and in you ssh server you disable the user-pass
functionality you will be invulnerable to a brute force. Is not
dificult to implement and users only need have the key generate by
you.
If you are intersted i will send you more details.

Sorry by my english




On Thu, Oct 16, 2008 at 7:24 PM, Gary E. Miller <gem@xxxxxxxxxx> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Yo All!

I am surprised no one has mentioned ftp with TLS (RFC 4217). It allows
you to use familiar FTP clients and procedures but allows you to have
the peace of minid of encrypted connections. Some clients, like IBM
mainframes have FTP/TLS installed by default but push back against
SSH/SFTP.

Also, all of these (FTP, FTP/TLS, SFTP, SSH) are still vulnerable to
brute force username/password attack. Blocking hosts on multiple bad
login attempts use to work, but now I see these dictionary attacks being
launched from botnet armies that only try 3 times a host against my
server. To mitigate dictionary attacks you have to use really long
passwords, one time passwords or public/private keys. None of these is
very user friendly.

RGDS
GARY
- ---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97701
gem@xxxxxxxxxx Tel:+1(541)382-8588

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFI978KBmnRqz71OvMRAkOZAKC19OskJKsd9qyMCen/LGx3wFpcuwCgm/bf
70OgT5JM8kVNGfmdiZEoo7E=
=FTxJ
-----END PGP SIGNATURE-----


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------