Re: Secure FTP
From: ESVOIT (esvoit_at_starpower.net)
Date: 07/18/04
- Next message: ESVOIT: "Re: red screen of death"
- Previous message: Lanwench [MVP - Exchange]: "Re: Secure FTP"
- In reply to: Zen Andreas: "Secure FTP"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 18 Jul 2004 14:18:18 -0400
For securing IIS and Windows, see here:
www.microsoft.com/technet/security
www.nsa.gov/snac
http://securityadmin.info/faq.asp#harden
http://securityadmin.info/faq.asp#ftpfolder
http://securityadmin.info/faq.asp#ftpencrypt
FYI, there is no way to do FTP that securely encrypts passwords without
requiring your users to use third party software. The only option I know of
for encrypted file transfer with no third party clients is to use a web
server with WebDAV such as the projects at www.webdav.org/projects along
with a web server certificate such as www.freessl.com Other alternatives
include using anonymous FTP, although everyone would be able to see any
files on your server with no password required, or to enable passwords and
not encrypt them. [The main risk of the latter is someone sniffing your
passwords, but this may be secure enough depending on your security needs.]
Whatever you do, don't permit anonymous user e.g. the IUSR account to both
read and write to any one FTP folder... instead, create a read only download
folder and a write only, no read "upload" folder.
Microsoft IIS can be plenty secure if you configure it properly and install
all the necessary patches regularly.
"Zen Andreas" <zen8069@zen.co.uk> wrote in message
news:u6CBWp$aEHA.3988@tk2msftngp13.phx.gbl...
> I want to create an secure ftp account on our server. But the
> criteria is that other colleagues should not require specialised
> software to connect. There is the option of using IIS but knowing
> that large sections of the global community are designing nifty
> tricks to hack or just breach whatever security arrangement it
> can offer, I was wondering what other practical alternative
> solutions are available.
>
> Your advice would be much appreciated.
>
> Thanks in advance,
> Zen
>
>
- Next message: ESVOIT: "Re: red screen of death"
- Previous message: Lanwench [MVP - Exchange]: "Re: Secure FTP"
- In reply to: Zen Andreas: "Secure FTP"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
