Forced to use a FTP server

[Grey Loki]

Here at work, we have a Win2k server running IIS5 that does our web server and FTP server. Ive got a Red Hat server in the works that runs Apache and ProFTPd. This server will take the place of the Win2k server.

Unforunately, Im a little nervous about the FTP part. Whenever I bring up FTP on Linux, people start yelling about how crappy FTP is and I should use SSH, etc etc.

My question is: Just how insecure is FTP? Do I really run a big security risk if I use it, even with a good configuration?

My problem is that we use that FTP site a lot, and we cant tell all our users to jump over to another type of software (i.e. SSH).

Thoughts?

[devurandomguy]

1) an ftp server on linux has got to be more secure than an ftp server on windows

2) ftp and ssh have two different functions. While you could probably tunnel ftp through an SSH connection, it would take a bit of work.. there is scp, but that is for upload only iirc (I havent had to deal with scp or ftp servers much, sorry)

[hlrguy]

devurandomguy is right.

FTP is for file transfer, while ssh is Secure Shell or terminal session.
FTP is inherently secure since you must always enter a password.
Even if you set root passwor to 'Null' or make it so that rsh can login
as root without a password, FTP will fail since a password is
unconditionally required.

That said, FTP will be as as secure as the passwords the Apache
enforces such as allowing userid 'hlrguy' password 'hlrguy'. Not
very secure. For all FTP users you can disable them from being
able to do anything except file transfer (i.e. block them from creating
directories, deleting files, etc that you can do in an established FTP)
session, and with UNIX/Linux, you can make all your users in a
group that provides ZERO access to navigate beyond the
directories you want them to have. i.e. CHMOD 770 your root
directory structure and noone who isn't in roots group (which your
FTP users would not be, can navigate nowwhere exept the one
directory where you give 777 permission. I would have to dedicate
more than 48 seconds to the security issue, but you get the idea.


hlrguy

P.S. I think the people at your work don't know really what they are
talking about since, being an FTP server, they are FTPing too/from
with Microsoft software. What is the difference if you use Linux?

[wilcal]

We use ftp on our LAN
We use SSH on the WAN

[neondog]

you can also lock the ftp users in the specified directory with the chroot command ( see the man pages on this). I use wu-ftpd and they explain how to set this up fairly well.

[Grey Loki]

What do you guys think is a good FTP server?

[The Elf]

The reason ftp is insecure is because passwords are transmitted in clear text. That is to say, if you had a sniffer on the network and were using a hub, or if there was a machine somewhere between the client and the server with a sniffer that could see the packets transmitted, it would have the password right there for it to sniff to a would be hacker. This is true of ftp on all platforms however, so a linux machine running ftp is no less secure than a windows machine running ftp than a solaris machine running ftp in this matter. There's also the possiblility of exploits in the server, which windows is prolly much worse on than linux. Now, with scp (secure file copy) you'll have encrypted passwords & transfers, so even with a sniffer it will be much harder to get the password.

[Lorithar]

And ... the above is why folks have been yelling about ssh.

There is an *extension* to ssh which allows for secure file transfer from the shell session ... I'm sure that if you check out Simon Tatham's site there's more info there about this ... it also requires that the ssh server have the capability ... I've yet to play with this so I've little knowledge of it other than the hint that its there..