Hot answers tagged

55

From the security they provide in theory FTPS and SFTP are similar. In practice you have the following advantages and disadvantages: With FTPS client applications often fail to validate the certificates properly, which effectively means man in the middle is possible. With SFTP instead users simply skip information about the host key and accept anything, so ...


49

I'm completely confused, though. What is the security benefit here? Nothing. The most likely scenario is that something in between is timing out the connection after 5 minutes to conserve resources. That could be a firewall, a WAN accelerator, an SSL accelerator, etc. Or it could be just a bad default setting. Who knows? Network admins often have ...


46

The sysadmin raises a valid point. (but his interpersonal skills might need work) SSH is a complex protocol, and openssh implements a lot of functionality. All this functionality offers attack vectors, and it is very hard to be sure that none of these vectors are exploitable. Even if openssh is without bugs (which it isn't), knowing about all the right ...


28

This sounds like a good example of a security "cargo cult". A security control has been implemented blindly without understanding the context involved or indeed implementing it correctly. Generally speaking in security the point of an idle timeout it to reduce the risk of situations where a client machine is left unattended and a malicious user gets to the ...


14

Both protocols have advantages and disadvantages, as explained very well in this comparison article. This said, since the question is specifically regarding security, there are a few considerations that should be taken into account when choosing which protocol is best in certain specific conditions. FTPS and FTPES use SSL or TLS to encrypt the control/data ...


13

I'm completely confused, though. What is the security benefit here? It might not be a question of security but have a different reason. Unfortunately your question only offers your view so we can only speculate what the real reason might be. One explanation might be that there is a simple stateful packet filter where the states time out after 120 ...


6

As you may have noticed this has nothing to do with security whatsoever. Instead, the practice of killing long-lived dormant TCP connections has to do with bugs - it's a work-around for buggy software. One of the more famous examples of software leaving TCP sessions hanging is Internet Explorer (at least up to version 7). IE had the habit of not ending TCP ...


2

You have almost always timeout on inactive TCP session implemented in routers, switches and all that low level network machinery. It has little to do with security in the sense of protection against a deliberate attack, but just try to not exhaust resources because of buggy software failing to close connection, or other hardware errors in external network ...


2

The authentication to ssh server goes in two steps. The first one is validation if your public key is in the authorized_keys file (or output of the appropriate command), the second one checks if the signature provided by the appropriate private part is the same. In the server log, you can see: sshd[9951]: debug1: test whether pkalg/pkblob are acceptable ...


2

Depends on the permissions given to the database user who you are acting as. If they have command execution privileges, it would be possible to use those to run a command such as id. Without that privilege, though, it is not supposed to be possible, but could be if the MySQL user was also a valid system user. In that case, it is possible to obtain the MySQL ...


1

I Have a few suggestions but no definitive best go to solution since it really depends on your specific use case. First off look into BerryBoot, it offers full disk encryption out of the box. A second alternative is to use any of the TrueCrypt like applications such as VeraCrypt It offers a bunch of options to either perform full disk encryption or make ...


1

Many people bring up valid points about the differences between the two protocols. But I think for your purposes, the question is really "Is SFTP Secure enough?" rather than "which one is more secure"?. As you've said, you have other concerns than simply security. This turns out to be a difficult problem to solve. SSH has been used extensively and ...


1

No, for the following reason: root could patch sshd to always try root's authorized_keys file as well as its own. Of course if root's private key gets stolen you have a bad day. Don't allow that. You would be much happier if root's private key only exists in /root on the server. If someone can become root they can steal it but that's of no account because ...



Only top voted, non community-wiki answers of a minimum length are eligible