Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

SSH File Transfer Protocol is a network protocol that provides file access, file transfer, and file management functionalities over any reliable data stream.

0
votes
1answer
62 views

Differ between encrypted and unecrypted FTP (21) without login

I'm looking at an IP range as a part of a project and discovered several FTP server. They all run vsftpd (3.0.2) on port 21. I do not have login credentials and anonymous logins are disabled. Can I ...
3
votes
5answers
523 views

How insecure… really… is FTP?

Okay, we know the drill: don't use FTP, use SFTP or FTPS. But what exactly is the risk being posed? The files themselves are sent unencrypted, and this may be fine, or disastrous, depending on what ...
0
votes
1answer
122 views

Filezilla for mac OS - Virus?

I hope this is the correct stack to post this. So I'm trying to download FileZilla for my macbook and I have McAfee installed, when I click in the download button, the antivirus flags it as Artemis!...
2
votes
0answers
365 views

FileZilla and private key with passphrase

I know filezilla can work with pageant for private keys protected with a passphrase, however can you use fileszilla with a private key that is protected with a passphrase without using pageant? I am ...
0
votes
2answers
82 views

Secure way to send files to server, store, then retrieve

I am looking for ideas today. The problem: Sensitive files are sent via REST (over SSL, of course) to a third-party server. I cannot touch them programmatically until they arrive at the server. Those ...
1
vote
0answers
30 views

Is it best to have HIPAA data pushed to me or to pull it and how do those solutions differ from an infrastructure and security perspective?

Long time reader first time asking. I have HIPAA data I need to get from point A to point B. Point A can either securely host the file to be pulled by Point B or push the data to Point B. I am ...
2
votes
2answers
246 views

Permissions for configuration file for program run as root that must be modifiable by SFTP

A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections. myscript uses a regexp (...
1
vote
1answer
678 views

What are the risk of NOT using a host key for SFTP using pysftp?

I've put together an ETL process with Python where I move some files from an SFTP server to a local sever. I'm following the directions from here: http://pysftp.readthedocs.io/en/release_0.2.9/...
4
votes
2answers
674 views

How does a client authenticate an SFTP server if there are no keys shared in advance?

For FTPS, we rely on the DNS and public PKI to authenticate the FTP server when we first connect. On the first connection, foo.example.com resolves to 1.2.3.4 and my connection comes back encrypted by ...
4
votes
3answers
368 views

Is it safe to use this embedded ftp server?

We are using a software suite for automation of FTP traffic. It uses the Apache Mina FtServer component as an embedded FTP server (for FTPS and SFTP). The use of this library has been flagged as a ...
2
votes
2answers
154 views

Does an unused ftp account pose a security risk?

I'm using BlueHost and have a few websites on my hosting. I decided to stop being lazy and start implementing some better security policies on my own part. Since FTP isn't secure, I changed to SFTP. ...
0
votes
1answer
87 views

How safe is it to edit PHP files in Web browser via CPanel? [closed]

For some reason my Notepad++ can't connect via SFTP since yesterday so I was thinking about editing my site via CPanel file manager which has HTTPS. I never thought about editing my site in this way,...
0
votes
1answer
90 views

Is SFTP going to improve Wordpress security?

Disclosure: I am a developer and not a security expert I am working on a Wordpress site for a client who is (understandably) concerned about WP security. The client will be hosting the site on their ...
1
vote
2answers
526 views

Client sent me an OpenPGP key; I need to generate key for SSH authentication on FTP server

One of my responsibilities is the monitoring of our company's SFTP sever, and making sure our clients upload the files we need from them daily. Until now they had username/password access, but we want ...
2
votes
2answers
410 views

Sending credit-card numbers through SFTP?

I need to send credit-card numbers and other information through SFTP. What considerations should I have? Recommendations? Is valid encrypt this numbers? What does PCI say about this?
4
votes
1answer
252 views

How to secure SFTP against symlink attack?

I've configured SFTP on my virtual machine, because I wanted to test how can I use symlink in order to access files outside from user home directory. I've created user: test:x:1003:1001::/var/www/...
1
vote
0answers
410 views

SFTP : “Skipping non-existing key file” - should I create a key file even with username/password security?

I set up a SFTP client on our server,our client requested username/password security. (I will change it to private key security at a later stage). Everything works, there are not setup issues and I ...
1
vote
1answer
77 views

Any known risks with Elastic File System?

I want to give some of my clients the ability to write files via SFTP, which later I can read from my main server. Since I'm using EC2, to do so I simply opened an Elastic File System (EFS) and ...
1
vote
1answer
134 views

Open SFTP on the main server - the safe way?

We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options: Open SFTP on our main server with restrictions (directory, user, size,...
2
votes
1answer
331 views

Securing an SFTP server

I have been asked to secure an SFTP service and running a scan using nmap.exe --script ssh2-enum-algos <host> -p 22 returns the following: 22/tcp open ssh | ssh2-enum-algos: | ...
0
votes
1answer
98 views

Public key for sensitive data

I'm curious about a setup that involves downloading sensitive information from an SFTP server over the internet. The current approach is for the clients to connect to the SFTP server with a private ...
2
votes
2answers
386 views

FTP client development - firewall issues

I am working on FTP client for internal usage for deployments. I have started out with WinSCP scripts, everything seems to be working fine, except one operation (deleting large(many files) directory ...
0
votes
2answers
449 views

SFTP server: should we prevent SSH host key changes?

We host a SFTP server and we encourage our customers to check the SSH host key when connecting. I was always under the impression that the SSH host key was fixed - it would only change when ...
1
vote
1answer
71 views

SFTP client and passwords

So I want to set up this client on a server which downloads (SFTP) the error logs of several defined servers Instead of having a configuration file containing the sftp credentials I am considering ...
2
votes
2answers
2k views

SFTP vs VPN and Samba share to share files remotely [closed]

I need to set up a way to share files securely and remotely with other users. I have a file server on which the user's files will be stored. Would it be more secure to have the users SFTP into the ...
-1
votes
2answers
78 views

SFTP user has access to its public key, is it an issue?

I have set up access over sftp, and the connection is jailed to the home directory of the user. In that directory is the .ssh folder, containing their public key. Is it a risk that they can access it?...
2
votes
1answer
770 views

Does SFTP cost more to implement than FTP?

This is a two part question. How does the implementation of SFTP differ over FTP? (Account Creation, Setup of connection) Is it more expensive (in terms of time/cost) to do so? In this scenario I am ...
0
votes
2answers
1k views

How to spoof SFTP?

Is there anyway to spoof an organisation that distributes files across the internet via SFTP? I know it's easy to spoof an IP address. But how easy is it to an SFTP link?
1
vote
2answers
1k views

How does SFTP work? Please help someone [closed]

We run a system that automatically sends a swift message at the end of a process. But this messages are sent using FTP. We feel the FTP process is too prone to MITMA and wish to change the sending ...
-4
votes
1answer
126 views

Using SFTP or SSH [closed]

If both SFTP and SSH both runs on same port #22. Then in which case do we need to use each of them separately.
0
votes
0answers
69 views

How to block ftp password guessers in shared hosting?

Is this also possible for shared hosting to: 1.use a web software to block password guessing attempts 2.change ftp port 3.locking down access to specific source IP addresses If none of above is ...
0
votes
1answer
177 views

FTP access instead of SFTP [duplicate]

We want to provide access to upload files on a FTP server. How to provide the access for the same? What is difference between a FTP and SFTP server?
3
votes
3answers
2k views

Mutual authentication of SFTP server

We can use public/private key pairs for client authentication when connecting to a SFTP server. Can we also have mutual authentication so the client also verifies a public key from the server? Both ...
83
votes
7answers
15k views

Does FTPS (FTP+S) offer better security than SFTP on the server side?

I had an exchange with some third party sysadmin yesterday regarding the setup of a file transfer interface between our servers. I suggested using SFTP because our application has good support for it....
3
votes
3answers
1k views

Is SFTP vulnerable to brute force, bounce, spoof, sniffing and port stealing?

I have been researching FTP and noted that using FTP means you are vulnerable to these types of attacks. I have been looking for an safer alternative and came across SFTP. Is SFTP still vulnerable to ...
3
votes
2answers
3k views

Setting up SFTP at Production Server is a Risk?

There is a requirement to setup a SFTP server. This will be used by some of user b2b agents to upload files. Such kind of setup is always doubtfully risky in production environment where user can ...
-2
votes
1answer
244 views

Samba - WebDAV - SFTP [closed]

I have an external online space and I can access the disk with SFTP, Samba or WebDAV. Which of these methods are the most secure? I am planning to copy about 200MB of data per day.
-1
votes
2answers
64 views

Secure protocol for a backup server? [closed]

I want to make a back up system in my home, but I don't know I should use a FTP server or a TPC-based cloud server or a SSH-based server. Which method is best in security? I just want to upload and ...
4
votes
2answers
129 views

Is it safe to expose a logging socket endpoint in a chrooted environment?

I'm trying to set up a file transfer server, which needs to be secured and logged. FTP was suggested, but that feels outdated so I automatically translated that to SFTP (OpenSSH) in my head. Using ...
5
votes
2answers
1k views

download file/folder anonymously on a ssh session

I rent a paid VPS hosted online and want to transform it to a sort of treasure chest where I can upload and download files privately. For this purpose I want to do this operation over the Tor network. ...
4
votes
3answers
2k views

SFTP on Windows - is it likely to be disabled?

I'm a software engineer and I'm maintaining a product that allows a user to run commands and scripts on Linux servers via an SSH connection. We now need to extend this functionality onto Windows. We ...
1
vote
2answers
643 views

sftp first connection before exchange cert

If a client connects for the first time to a server via SFTP, the first connection before receiving the server certificate is transmitted in the clear?Let me explain: it is assumed that the client ...
2
votes
1answer
15k views

SFTP or FTP through VPN?

I'm struggling to find out whether or not I should set up SFTP since I already connect to the internet using a secure VPN. Is the security using FTP through a VPN (using OpenVPN, more specifically ...
0
votes
1answer
102 views

Period and direction of risk when connecting to malicious webserver

Please forgive my terminology mishaps. Recently, I tried to connect to a server over SFTP. The SSH public key response differed by 1 byte to what I was expecting, from an info page. I was tempted to ...
0
votes
1answer
214 views

Should I use the root account on my Digital Ocean server?

I have set up an SSH key with Digital Ocean that is automatically added to any servers I create. Is it okay to use this root account for SFTP and daily use or should I create another user account and ...