Despite being a million years old, FTP still comes in handy for remote file management. In fact its sheer usefulness even manages to outweigh the obvious security risk that comes with using it - no encryption.
Passwords and data are still sent in plain text over the network, not usually an issue if you’re on a secure point-to-point environment, but still in this day where security is now probably the biggest part of IT, it takes some getting used to to let it happen.
Your best choice to secure FTP is to use FTPS - that’s basically FTP wrapped in some good ol’ fashioned SSL. I decided to upgrade an FTP server to use FTPS, but it didn’t go as well as expected.
vsftpd was my final choice, which I got working successfully with a self signed SSL certificate. However I started suffering all kinds of bugs at the TLS level, with FileZilla’s FTP client constantly failing to set up an SSL session. Even enabling all the logging and ssl_debug option didn’t give me an insight into the problem. So I started looking for alternatives.
The solution was to abandon FTP entirely and rely on the SSH service already running - by using SFTP.
Commonly confused with “Simple FTP” or “Secure FTP”, it’s actually “SSH FTP” which utilizes OpenSSH (or whatever SSL library you use, but come on… lets be realistic!) to upload, download, rename, create and delete\move files using a client which supports it (such as FileZilla). No new services or configuration are required as the authentication\encryption is managed by SSH.
So if you’re on the market for a secure remote file management tool - I’d highly recommend the one you probably already have ;)
|Posted August 17, 2012||Tweet|
|Written by John Payne|