Re: Secure file transfer

"Sebastian G." <seppi@xxxxxxxxx> writes:

evans@xxxxxxxxxxxxxxxxxxx wrote:


In Core FTP, is it better to use AUTH SSL or SSH/SFTP?


SSL. SSH/SFTP only protects the data transfer channel, not the command channel.

No idea what you are talking about. ssh encrypts everything passing between
the two computers.


This may (or not) have a bearing on it. When I connected using AUTH
SSL, the connection script said:

...
AUTH SSL
500 This security scheme is not implemented
...

It then went on with the connection. I contacted the people who are
hosting my account and the first guy said that :

"That error message is misleading, it means that the ssl cannot be
authenticated but it will still use the encryption layer."


Well, are you doing implicit or explitic SSL authentication?

In Winscp, which only uses SSH (and I have that enabled in my
account), One of the fields in the login screen is "Private Key File".
Core FTP did not have such a field. In any case, what happens if I
leave that field blank?


Nothing.

Is my password and data going out unencrypted if I have not set up a
private key?


No. It just means that the server cannot authenticate you, that is, the
server doesn't know who he's talking to. A malicious user might insert
commands on the command channel on your behalf without being detected.

??
.

Relevant Pages

  • Re: Secure file transfer
    ... SSL, the connection script said: ... are you doing implicit or explitic SSL authentication? ... A malicious user might insert commands on the command channel on your behalf without being detected. ...
    (comp.security.misc)
  • Re: Secure file transfer
    ... SSH/SFTP only protects the data transfer channel, not the command channel. ... SSL, the connection script said: ... are you doing implicit or explitic SSL authentication? ...
    (comp.security.misc)