Re: Good secure file transfer, was Re: How safe are FTP servers?

Nico <nkadel@xxxxxxxxx> (07-05-28 02:19:45):

I've had good success migrating companies off of it to HTTPS for
download and HTTPS/WebDAV for upload.

You migrate people *from* FTP to WebDAV, in the name of security?
I'll grant that you've already said you're using HTTPS which is
obviously the right way to go ...

Probably that's even too complicated. For most applications, there
are much easier alternatives, which are equivalently secure.

Oh? For download, HTTPS is fine and well supported, and has plenty of
clients available for the scriptable, command line, or graphical
interfaces. And unlike FTP, requires only a single firewall port
without complexities to handle the traffic. And most web servers
already have the "restrict user to single directory access", very
flexible controls over symlink handling and directory browsability,
multiple well-supported user authentication techniques, etc.

The user authentication is what I'm referring to. Cryptographical
authentication via HTTPS has some remarkable difficulties compared to
other protocols. This is because HTTPS is mainly used to authenticate
servers, not users.


FTP has some of those, but breaks down on the clear-text user login
and password handling. And the mutliple ports causes real problems
with firewalls and proxies set up to be quite fascist.

I don't think that I sounded like a supporter of FTP, but if I did, then
I'm sorry. I hate FTP.


SSH/SFTP/SCP have very, very serious flaws in controlling user access
to the server's file system. They work well for certain operations:
having a command line browseable, more secure tool than FTP is good.
But The lack of a chroot cage to hide server content, such as /etc/
passwd or other configuratoins, and the difficulty of preventing shell
access for SSH users, all lead to some real risks in running it on a
server. There are some SSH servers that provide this (RunSCP comes to
mind), but they're nowhere near as commonly deployed as plain old
OpenSSH.

SSH means `Secure SHell'. That implies regular shell access. However,
if you system is configured properly, then there is no problem with
that, besides that it adds a further layer of potential security
problems. To avoid that, avoid SSH, or chroot it (which is well
possible [1,2]).


Regards,
Ertugrul Söylemez.


References:
[1] http://chrootssh.sourceforge.net/index.php
[2] http://www.brandonhutchinson.com/chroot_ssh.html


--
Security is the one concept, which makes things in your life stay as
they are. Otto is a man, who is afraid of changes in his life; so
naturally he does not employ security.
.

Relevant Pages

  • Good secure file transfer, was Re: How safe are FTP servers?
    ... download and HTTPS/WebDAV for upload. ... I'll grant that you've already said you're using HTTPS which is ... FTP has some of those, but breaks down on the clear-text user login ... There are some SSH servers that provide this (RunSCP comes to ...
    (comp.os.linux.security)
  • Re: I Need a firewall recommendation.
    ... > Since there are two servers the firewall must have some way to route ... For SMTP, HTTP and HTTPS, this coudl be achived by inserting proxy ... For FTP you are stuffed. ... but that might cause firewall problems for the remote ...
    (comp.security.firewalls)
  • [NEWS] Transparent Cache Engine and Content Engine TCP Relay Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The default configuration of the proxy ... The following Cisco Cache Engine and Content Engine products are affected ... of supported protocols such as FTP and HTTPS. ...
    (Securiteam)
  • Re: is HTTPS crackable
    ... (willing to question HTTPS protocal security prior to questioning ... OWA55/Kiosk security), not necessary Microsoft's strategy. ... > public Internet access by a kiosk, ... > about downloading and installing the self-signed certificate. ...
    (microsoft.public.inetserver.iis.security)
  • RE: Mitigate FTP
    ... Yes, using ssh/sftp will help; ... For your customer base, I assume they are mostly Windows users; ... Security may be able to fine tune the threshold accordingly. ... Subject: Mitigate FTP ...
    (Pen-Test)
Quantcast