6

I'm going to be hosting one of my websites on a VPS soon and I want to make it as secure as possible. Only I will need access to the VPS, and I can't see that changing in the near future. Because it is an eCommerce website, I will be purchasing an SSL certificate anyway, and I'll also have SSH access, so I'm not sure which is better.

I've heard that SFTP is favored by most people and that it doesn't need as many ports open as FTPS, but are there any other factors to consider?

Also, I've heard that SFTP offers another form of authentication besides a username and password, but because I'm new to all this I'm not quite sure. Could someone explain this?

Improve this question

1 Answer 1

Reset to default
7

The nice part of SFTP is that it's incorporated within SSH. Which means that you needn't install additional software. Security-wise, I'd say they are equally secure. There are however a few pros and cons:

FTPS

Pros:

  • Widely known and used
  • The communication can be read and understood by humans
  • Provides services for server-to-server file transfer
  • SSL/TLS has good authentication mechanisms (X.509 certificate features)
  • FTP and SSL/TLS support is built into many Internet communication frameworks

Cons:

  • Doesn't have a uniform directory listing format
  • Requires a secondary DATA channel, which makes it hard to use behind the firewalls
  • Doesn't define a standard for file name character sets (encodings)
  • Not all FTP servers support SSL/TLS
  • Doesn't have a standard way to get and change file and directory attributes

SFTP

Pros:

  • Has good standards background that strictly defines most (if not all) aspects of operations
  • Has only one connection (no need for DATA connection)
  • The connection is always secured
  • The directory listing is uniform and machine-readable
  • The protocol includes operations for permission and attribute manipulation, file locking, and more functionality

Cons:

  • The communication is binary and can't be logged "as is" for human reading
  • SSH keys are harder to manage and validate
  • The standards define certain things as optional or recommended, which leads to certain compatibility problems between different software titles from different vendors
  • No server-to-server copy and recursive directory removal operations
  • No built-in SSH/SFTP support in VCL and .NET frameworks
Improve this answer
4
  • Thank you very much for your answer. Please could you explain a bit more about the SSH keys though?
    – Andy
    Jul 22, 2013 at 13:17
  • Well SSH keys are a type of certificate which allows you to authenticate yourself against a machine without having to use a password. So you just need to present the file which is called a key.
    – Lucas Kauffman
    Jul 22, 2013 at 14:24
  • Ah, thank you. So, would you say that in my case where only I need access via SFTP, using an SSH key would be better than a password because then it's much harder to crack?
    – Andy
    Jul 22, 2013 at 16:06
  • It's harder to crack but it's also less flexible, you need to store the key somewhere.
    – Lucas Kauffman
    Jul 22, 2013 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .