Re: Secure file transfer

On Dec 16, 5:04 pm, "Sebastian G." <se...@xxxxxxxxx> wrote:
ev...@xxxxxxxxxxxxxxxxxxx wrote:
In Core FTP, is it better to use AUTH SSL or SSH/SFTP?

SSL. SSH/SFTP only protects the data transfer channel, not the command channel.

I don't know enough about it to understand how that addresses which is
better to use.


This may (or not) have a bearing on it. When I connected using AUTH
SSL, the connection script said:

...
AUTH SSL
500 This security scheme is not implemented
...

It then went on with the connection. I contacted the people who are
hosting my account and the first guy said that :

"That error message is misleading, it means that the ssl cannot be
authenticated but it will still use the encryption layer."

Well, are you doing implicit or explitic SSL authentication?

Not being familiar with these terms, and failing to find definitions
that I could understand, I don't know. I enter a username and password
into the login screen, which I would intuitively think would mean
"explicit", but I don't understand how that relates to whether my
password and data are encrypted. If I were familiar enough with these
things, I would probably not have to post questions to begin with.

In Winscp, which only uses SSH (and I have that enabled in my
account), One of the fields in the login screen is "Private Key File".
Core FTP did not have such a field. In any case, what happens if I
leave that field blank?

Nothing.

Thanks! I can understand that answer.


Is my password and data going out unencrypted if I have not set up a
private key?

No. It just means that the server cannot authenticate you, that is, the
server doesn't know who he's talking to. A malicious user might insert
commands on the command channel on your behalf without being detected.

Ok, thank you.
.

Relevant Pages

  • Re: Secure file transfer
    ... SSL, the connection script said: ... are you doing implicit or explitic SSL authentication? ... A malicious user might insert commands on the command channel on your behalf without being detected. ...
    (comp.security.misc)
  • Re: Secure file transfer
    ... ssh encrypts everything passing between ... SSL, the connection script said: ... commands on the command channel on your behalf without being detected. ...
    (comp.security.misc)
  • Re: Mixed Mode Authentication in .net 2.0
    ... There are two parts to SSL, which is why this can be confusing. ... encryption and authentication of the server. ... ADFS supports a component called the federation service proxy which is ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Search not working
    ... Management>Authentication Providers>Edit Authentication, does not provide the ... ability to indicate whether the web application is using SSL or not. ... I changed IIS Authentication for the web site back to Integrated ... I have installed an SSL certificate and required SSL ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Can SSL sessions be compromised?
    ... the proxy machine -- if I enable local cookies for authentication this ... your "SSL server" machine may be trying to catch some simple types of ... information carried by the digital certificates was ... clicking on any RFC number, brings up that RFC in the lower RFC summary ...
    (comp.security.misc)