I had an exchange with some third party sysadmin yesterday regarding the setup of a file transfer interface between our servers.
I suggested using SFTP because our application has good support for it. My interlocutor absolutely wants FTP+S (FTP+TLS) which we currently don't support and would need to develop.
I argued that I did not see any real benefit in FTP+S over SFTP since both offer solid traffic encryption. SFTP is readily available and can be made even more secure with public key authentification. Last but not least, its single connection mode makes it much nicer to use behind corporate firewalls.
The sysadmin almost called me an idiot, stating that SFTP works on top of SSH which is a protocol designed for administration purpose, and that opening a SSH port for any other use than administration is clearly a bad idea because it opens a broad attack vector against the host system.
I am wondering if this argument is valid. There seem to be various ways to restrict a SSH session to only allow SFTP file transfer. There is the internal-sftp subsystem that comes with openSSH, where you can easily set up a chroot and disable TCP forwarding. I even heard about solutions that presumably allow users to connect via SFTP without requiring an entry in the passwd file... I do not see any clear problem with SFTP that you would not have with FTP+S, but I could be missing something?
So, despite of the restrictions that you can apply to SSH, is FTP+S a better option for file transfers, security wise?