Slashdot Mirror

← Back to Stories (view on slashdot.org)

Ask Slashdot: Secure FTP?

Posted by Cliff on from the for-the-paranoid-sysadmin dept.

Tobbe Johansson asks: "I would like to put a secure layer between my FTP-daemon and the network. I have searched for a program that encrypts/decrypts the port where my FTP is running but I have not been able to find anything that seems to work. Can anyone help me?"

2 of 85 comments (clear)

  1. SSL/TLS FTP by Jordy · · Score: 5

    You can use an industry standard encryption and authentication protocol with FTP supported by various clients.

    First, go to http://www.openssl.org/. OpenSSL is based on SSLeay and is the basis for open source SSL communications in unix. You'll want to grab openssl and compile it and install it. It provides a number of useful programs including md5 & sha for generating checksums on files and a whole suite of other cipher routines.

    Next visit http://www.psy.uq.oz.au/~ftp/Crypto/ and go find an FTP server and client pair which have SSL support. There are also a few general proxy deals which can handle it with any standard FTP server.

    Now there are a few ways to do authentication, you can do normal authentication or authentication based on certificate which requires a CA server (things like verisign will work if you want to shell out some cash, but you can also build your own CA).

    The great thing about SSL is it can autodetect encryption support. So you can take a standard telnet server, make a few minor modifications to get it SSL capable and connect to it using SSL capable telnet client or a vanilla telnet client and it'll use the strongest security possible.

    No need for silly third party daemons or special ports. Although the official TLS service ports are different from their unencrypted couterparts.

    This is good if you are behind a corporate lan which doesn't like allowing anything besides telnet, ftp, and web traffic through their proxy.

    --

    --
    The world is neither black nor white nor good nor evil, only many shades of CowboyNeal.
  2. Secure FTP: A few ways by angio · · Score: 5
    As a previous poster suggested, use ssh with port forwarding. You might want to see the SSH FAQ:

    http://www.uni-karlsruhe.de/~ig25/ssh-faq/

    As it points out, this will leave the data connection open to sniffing/hijacking. If you only care about the integrity of the files you transfer, then verifying against (securely obtained) md5 checksums should do the trick. If you want to encrypt the datastream, you'll need to be a bit more fancy.

    If it's possible, consider the use of 'scp' instead of ftp; you'll get protection of both control and data, since it's built into ssh.

    Another option (if you control the clients as well) is to use ssh2's "sftp" client. Beware the licensing issues with ssh2, however.

    If you really trust the clients, it's also quite easy to set up a VPN between the client and server, and then FTP directly. The ways to go about this depend on the OS you're using, so I'll leave it as an exercise to the reader.