1

Which of those two protocols is the most effective for sending data from a client to a server on a local network (knowing that I aim to use it for FTP traffic)?

enter image description here

1
  • My grammar is litlle bad. I'm so sorry!
    – No Name
    Commented Feb 5, 2016 at 11:32

4 Answers 4

1

Both will do what you need effectively.

Whether you need to use one over the other depends on your use case. From what you have described, as long as there aren't other requirements, I'd go with TLS, as it requires very little additional work on most network architectures.

IPSec is just a little more convoluted to set up - but it does provide additional security options.

2
  • I'm making FTP server and I send my data to the FTP server. I have dilemma. By the way, please don't use complex sentence, write simple sentence, because I cannot catch your mind clearly.
    – No Name
    Commented Feb 5, 2016 at 11:49
  • summary - use TLS in this case :-)
    – Rory Alsop
    Commented Feb 5, 2016 at 12:16
1

Both are effective. I feel it depends on how nicely you configure your protocols. The Better you configure the better security you get. example: better algos (example hmac_md5 in place of md5), public -key-cryptosystems etc Like choosing main mode in ipsec in place of aggressive mode for more security etc. Choosing Certificates in place of preshared key etc

It also depends on the use case. On local TLS/ssl as ipsec has more options .

0

First, quit using FTP entirely.

The most common choice is to use SFTP instead

  • Disable weak cipher suites like ones using RC4.

  • There are other hardening steps you can take as well.

The next common choice is to use FTPS instead.

  • Disable weak cipher suites like ones using RC4.

  • There are other hardening steps you can take as well.

If you would like, you can ALSO use OpenVPN or another TLS based VPN, or an IPSec VPN, as an additional layer.

  • Properly configured, IPSec and OpenVPN are equally effective

    • Use good, modern cipher suites

    • Use certificates whenever possible, rather than password based authentication

You can also encrypt the files themselves.

More layers helps

  • VPN first

  • secure file transmission second

  • encrypted files third.

4
  • 1
    What's wrong with FTP over IPSEC? Commented Feb 5, 2016 at 19:28
  • @NeilMcGuigan Technically, if there are no flaws or compromises, FTP over IPSec should be fine. However, any internal audit is going to throw up a huge flag for having FTP, an insecure protocol, even turned on, which has to be explained every time. Any failure in the firewall configuration opens up the data, usernames, and passwords as well (it's not as uncommon as you might think when people are in a hurry, or Sales/Marketing says "Just get this file transferred right now - I promised it to them by FTP today"). Lastly, there's no reason to use FTP when SFTP, or even FTPS, is available. Commented Feb 6, 2016 at 16:57
  • While I agree SFTP is the much better choice, this doesn't answer the question at all.
    – Rory Alsop
    Commented Feb 13, 2016 at 14:08
  • @RoryAlsop - added direct answer. Commented Feb 13, 2016 at 16:43
0

FTP over SSL/TLS is usually known as FTPS. The problem with this is that, by default, the initial socket connection is used for control, and a second socket is established for data transfers. This second socket may use a range of port numbers making it more difficult to restrict access and requires close integration between the application and SSL layer (you can't simply point your FTP client at stunnel). Although it's possible to use a single channel (passive mode) enabling this at both ends can pose complications.

This is less of an issue with IPSEC, and, depending on how it is configured, will give lower latency, but you need to disable end point authentication if your connection crosses NAT. IME there is more effort in configuring an ipsec connection, although it has been some time since I did such a thing, hence FTPS might be easier for infrequent transfers.

Really you are comparing apples and oranges here. And we can't say what is more effective without knowing what your criteria for effectiveness are.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .