Re: securing communication channel (FTP) - Need Suggestions

kurt_at_noaddress.org
Date: 06/28/05

  • Next message: techpsi_at_yahoo.com: "Re: program to store passwords" 
    Date: 28 Jun 2005 15:40:31 -0000
To: security-basics@securityfocus.com
    ('binary' encoding is not supported, stored as-is) Firstly, base your choice on the need, not on what standard.

    What HW platforms do you have, what products do they support, do you have communication within or outside of the organisation and if so, what standard do the external partner have or is willing to use/accept.

    When you know that, you know what to use as 1:st choice.

    > (1) Secure FTP (SSL:FTPS)
    >
    > - Any pitfalls I need to be aware of from a
    > setup/implementation standpoint?

    Haven't used FTP/S so I can't really say, but on AS/400 and some other IBM mainframe env. it is standard. SSH/sftp do not exist. Tumbleweed and Ipswitch have Unix/PC versions.

    > - How would the authentication to MySQL user
    > database work?

    ? Wasn't it ftp the question was about? Do not run MySQL or any ftp-pluggin.
     

    > (2) Secure HTTP (https)
    >
    > - Any pitfalls I need to be aware of from a
    > setup/implementation standpoint?

    Isn't real ftp, need the backend "CGI" to check transport. Usage more depending on if only web-access or not. Probably more unsecure, due to more security failings in web servers.

    > (3)
    > a. Scp:
    > b. Sftp: Is it an interactive program? Does it
    > provide non-interactive authentication?

    Well, if using sftp (scp) you have ssh and therefore can let all terminal users run ssh, increasing security. On the other side, do you have ssh, you already have sftp, same coin.

    Have only worked with sftp, not scp, but with certificates generated, it is easy to make batch processes for it. Basis is the following (can be made more "unreadable" = efficient) Solaris Unix script: 

    ---
SFILE="$HOME/cache/acme.dat"
/usr/5bin/echo "put $SFILE \n quit \n" |\ 
  sftp acme.batch@ac1.acme.com
---
Did a sftp batch control shellscript some months ago, that now runs regular for a data transfer.
Server exist for PC and different Unixes as well as OpenVMS (HP own version recommended by users). ws_ftp client/server works both ftp/s as sftp (and PGP to top up ;-) SSH.com and F-Secure/WRQ have the most known commercial versions, while OpenSSH.org is the freeware. 
Only thing to remember, if you run OpenSSH Win-server, the server needs to be run as a ordinary process, not server, and to own it's resources and disk areas. We had problems with that.
regards/kurt
  • Next message: techpsi_at_yahoo.com: "Re: program to store passwords"

    Relevant Pages

    • Re: SSL capable FTP _client_?
      ... > scp is also included with ssh. ... sftp itself is not very handy, no reconnect support build in so ... support then with sftp support. ... [The Cardigans - No sleep] ...
      (Debian-User)
    • Re: Batch job to perform sftp transfer
      ... It relies on copying datasets to temporary HFS files ... I used /bin/cat with ssh so that I could transfer the data and pipe it to ... The IBM version of sftp doesn't support datasets, ... Batch job to perform sftp transfer ...
      (bit.listserv.ibm-main)
    • Re: secure file transfer FROM z/OS
      ... FTPS. ... SSH SFTP. ... This is supported by z/OS Ported Tools - OpenSSH. ... better native z/OS features than Ported Tools SSH ...
      (bit.listserv.ibm-main)
    • Re: SPAM sudden increase
      ... up ssh for some sftp session and saw something odd... ... Dude was on a tech call with f-secure and the tech asked, "So, are you ... To which the dude replied, "Yeah, I'm ...
      (alt.2600)
    • Re: SFTP is not working
      ... When I try to use sftp or scp2, I get a message like this: ... sftp and scp2 both actually work by running ssh in a subprocess, ... The reason the shell startup files are relevant at all, ...
      (comp.security.ssh)
    • Quantcast