0

I need a good explanation- and I don’t think this site has one.

As for my Web app, users (and I) will need to upload and transfer data- and I know the basic uses of SFTP and FTPS but I need a good security focused answer, please.

P.S. I added the tag FTP even though I am asking about FTPS.

0

1 Answer 1

5

FTPS is just FTP wrapped inside TLS. SFTP is a completely different protocol to transfer files over SSH.

Both of them can be cryptographically weak or secure depending on how they're configured (ciphers, key exchange, etc). But there are a few key differences you should be thinking about from a security perspective:

  • FTPS uses a data channel like FTP, so can make firewall rules more complex.
  • SFTP will usually rely on host keys, while FTPS will use a normal x509 digital certificate - so you either need to be managing SSH keys or digital certificates.
  • Most SFTP implementation support SSH keys out of the box authentication, and while you may be able to setup FTPS with certificate authentication it's more complex to do so.
  • SFTP is supported by OpenSSH - so if you're already running that then you don't need to install a separate daemon.
  • If you use SFTP you'll need to expose the SSH service, which has security implications if you use it for administration as well.
  • You need to be careful with how you configure SFTP to prevent users from logging in over SSH and executing commands.

But ultimately, the configuration and specific implementation matters much more from a security perspective than the protocol. If they're well configured and using a patched and robust implementation, then both of them are secure.

Not the answer you're looking for? Browse other questions tagged .