Re: Changing sftp-server to some other ftp server

From: Nico Kadel-Garcia (nkadel@bellatlantic.net)
Date: 04/09/02 

From: "Nico Kadel-Garcia" <nkadel@bellatlantic.net>
Date: Tue, 09 Apr 2002 10:22:50 GMT

"Alvin" <achanjunk@yahoo.com> wrote in message
news:a156face.0204081935.55cbd4a7@posting.google.com...
> Hello all
>
> I have been doing some research on secure ways of using ftp. From
> what I read, sftp, that is using ssh over normal ftp sounds like th
> emost practical and secure. I think someone mentioned that the ftp
> protcol in sftp-server is using sftp2. What does that mean? Is that
> have anything to do with ftp over ssl? Also with the subsystem calls,
> can you employ other services over it? I don't know how secure
> sftp-server is in the area of coding. wu-ftp I have read is notorious
> with vulnerabilities (and so is sendmail, but that was from Dan
> Bernstein's site), if I want to use vsftp server instead of
> sftp-server, but have the ssh encyption and authentication. Also
> sftp-server does not support restart [bytecount] command. Not that
> there are any sftp client out there can take advantage from it, but it
> is something I believe necessary for the future of sftp.

No, sftp uses scp2, or the scp function as used by the ssh2 protocol. There
are two protocols, ssh1 and ssh2. For various amazingly stupid reasons, when
ssh.com created ssh2, they left it on the same port number as ssh1, and
we've had problems ever since with confusion about them. It has nothing to
do with SSL except using some of the same encryption libraries.

Also, sftp and sftp-server is one of the worst excuses I've seen for an ftp
interface ever. It actually succeeds in being worse than Microsoft's command
line interface: it doesn't support mget, mput, ls -R, ls -l, or many other
useful and normal ftp commands, wildcard expansion of any sort, and is only
really useful with a GUI. And the last time I looked, there was no good GUI
for it.

Just use ssh, scp, or WinSCP2 if you need a graphical interface for your PC
users.

> Anyone wants to comment on ssl and ssh in the areas of ftp or
> tunnelling please feel free to answer it on this thread as well. That
> is also something important to have a look at, at least for me in
> recommending decisions.

SSL tunneling ftp is, well, an adventure. There are some published encrypted
versions of ftp: secureftp is one of them, and if you can find decent
clients may make your users happier than sftp.

> Enough garble I suppoe and back to work

Enjoy...

Relevant Pages

  • Re: Secure file transfer
    ... We're talking about SFTP, which is a variant how to use SSH to secure the ... FTP protocol. ... is it better to use AUTH SSL or SSH/SFTP?" ...
    (comp.security.misc)
  • Re: Secure file transfer
    ... We're talking about SFTP, which is a variant how to use SSH to secure the ... FTP protocol. ... "FTP over SSH" is the protection of the command channel. ...
    (comp.security.misc)
  • Re: Simple file sharing between FC2 and Mac OS X?
    ... > SSH should work great but you'd need a real user account on her machine. ... I use Nautilus with SFTP to ... > transfer files to/from my laptop, web server, etc. ... > ftp server, or both. ...
    (Fedora)
  • SFTP with no SSH session
    ... Suppose someone has telnet and FTP access to his System. ... suppose I have SSH and SFTP access to my system. ...
    (comp.security.ssh)
  • Re: FTP over SSL
    ... As far as I know, there is no way to wedge FTP over SSL, and I've ... What you really want is a secure file transfer MECHANISM. ... SSH suite of programs comes with such a thing, ...
    (comp.security.ssh)
Loading