FTPS with IP restriction OR SFT over SSH without IP restriction - which one is more secure?

Question

Im able to connect to my managed Linux Ubuntu Server only through

FTP using explicit SSL (Auth TLS) with IP restriction

and

SFT over SSH without IP restriction

Question: which method is more secure to upload and download files?

Update:

Secure against what? Sniffing, spoofing, brute force attacks and other basic attack methods.

Answer 1

This question has beed discussed in stackexchange and online already (e.g. see this article) but I'll try to address your specific points.

As a clarification:

• FTPS = FTP Secure, which is FTP over TLS
• SFTP = file transfer by using the SSH protocol
• FTP over SSH = (unencrypted) FTP through an SSH tunnel

Assuming that you have the first and second options available, both are encrypted so sniffing does not have any significant effect (unless you can somehow find the decryption key, of course).

Spoofing is a quite broad subject, but I assume that you mean either server impersonation (where your computer is tricked into thinking that an attacker's computer is the legit FTPS/SFTP server) or a man-in-the-middle attack. In this case, it all depends on the setup; the FTPS clients and server should use valid CA certificates (that they can use to verify each other's keys); the SSH server should have its public key transfered to clients through a secure channel before any client connects to it. If you take all the security measures that are required for each type of server, then spoofing becomes very difficult to succeed.

Brute force attacks are dealt with differently, depending on the type of the server and the type of authentication you're using (password or key based). In general, key based authentication is immune against password brute force attacks (because it does not use passwords). Aside from that, if the server or system has some sort of protection against brute force attacks (e.g. account disabling after a number of failed attempts) then you can mitigate its impact (although, locking an account essentially transforms a brute force to a denial of service).

So, in general, with good security practices, both can be seen as equally secure. Having said that, I personally prefer SFTP, the OpenSSH implementation in particular, for the following reasons:

• it has stood the test of time, security wise (also see here). This makes me feel comfortable using it
• you can configure key based authentication which makes brute force attacks useless
• it's easier to use with firewalls - FTP can be active or passive and requires two ports (one for control, one for data) which makes configuring a firewall a bit more complicated compared to SFTP