If Ftp Is Not Secure

How unsafe is FTP?

Posted by Jaapyse

Hi,

I apply FTP on a daily ground, and I mean FTP over the Big Bad Internet. I like it because Windows Server has a built-in FTP customer and it's really easy to use on near Linux besides. However, my gut tells me this isn't condom. How much of a security risk is this?

How much access could a malicious outsider gain and what tools / knowledge / connectivity would he demand in order to gain this access?

How tin I improve the security of this while maintaining the aforementioned usability and accessibility?

- Jaapyse

63 Replies

M Boyle

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

ghost chili

At that place is no encryption at all. So the information existence transferred is readable. More importantly the login details can exist read past anyone sniffing packets.

In itself this may not exist critical merely people do have a habit of reusing passwords. And then it tin can lead to account compromise elsewhere.

Once an attacker is in a position to sniff the packets it becomes a pretty like shooting fish in a barrel thing to practise. Getting that access can be hard, simply can also be surprisingly easy. Information technology merely depends on where the traffic is flowing.

How can I amend the security of this while maintaining the same usability and accessibility?

This is always a compromise.

SFTP solves most of the security issues and plays nicely with firewalls merely you exercise take to put in a piffling more endeavor in the setup phase. Buy you are in Information technology and that is office fo the job.

vi found this helpful thumb_up thumb_down
Yous are admittedly correct. FTP on it'southward own is not secure. Y'all are non only transmitting user id/password over the Internet in articulate simply are transferring your files in clear also. Ane step above is SFTP or FTPS (there is a subtle difference). A much better pick is HTTPS. I say it is a much better pick because a web server allows you lot to add together extra features like notifications, scripting after files are transferred as well as whatsoever other business organization logic you lot need.

1 such spider web server is SynaMan (http://synaman.com). It works pretty much like an FTP server merely does transfers are made over HTTP(S) and is much secure. It works pretty much like an FTP server - meaning you create virtual folders and and so assign these folders to one or more users.

1 of 3 constitute this helpful thumb_up thumb_down
What are yous using it for?

If you're anonymously downloading images from mirror sites, then fine.

If it's anything y'all need to log in for, and you lot're not encrypting it in some style, and so conduct as though the system is compromised.

7 plant this helpful thumb_up thumb_down
A special nightmare scenario would be a Microsoft IIS serving FTP with domain credentials to the WAN side, while y'all also employ the aforementioned domain authentication for VPN or some RDP sessions.

Just by sniffing the network traffic, anyone could get the username/password of the FTP user and than employ it to break in over a VPN or RDP session.

I use normal http for unimportant files that don't demand any hallmark, while the residue goes over SFTP.

Blake mentioned post transfer actions - really my Reflection for the Secure IT server (SFTP server) as well supports post transfer actions. Merely it's truthful, that this is non a mutual characteristic, especially non at the lower price rank. But it's also non really common with Web servers to offer post transfer actions functionality.

3 found this helpful thumb_up thumb_down
Very. SFTP and FTPS protocols are both much safer and all modernistic FTP clients can connect using them.

Was this post helpful? thumb_up thumb_down
EdT

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

habanero

It's just bad. It's a case of "Hey, the 80'south but called; they want their insecure protocols back..."

Just like telnet!

four of five found this helpful thumb_up thumb_down
Seydon

This person is a verified professional.

Verify your business relationship to enable It peers to encounter that you lot are a professional person.

tabasco

It is as bad as if you'd do fiscal transaction with your banking company over HTTP.... Would you connect to your bank's online portal if it was only HTTP?

Your credentials are not encrypted, and if you transfer sensitive data over plain ftp, anyone tin read that data...

As many mentioned SFTP (ftp over ssh) or FTPS (secure FTP) are a lot meliorate. IIS supports FTPS, you just need to add together a certificate (self signed may be enough - depending on your usage)... command prompt ftp client from Windows doesn't support it though... All the FTP clients I know do support it...

I retrieve it would also exist easy to configure FTPS with any Linux FTP server... SFTP is available by default when you configure SSH on your Linux box...

0 of 1 constitute this helpful thumb_up thumb_down
We had an on site FTP server for years until 5 years ago when I started checking the logged log in attempts.

It wasn't soon after the that nosotros moved to another service to send receive larger files.

Also all the reasons listed in a higher place.

I call back if you are using FTP behind a firewall, like moving files to/from Linux and Windows it's fine, but if you are making web visible connections using recycled credentials y'all are a security hazard.

1 found this helpful thumb_up thumb_down
Here is a way to think about it... if there was a scale of safe and unsafe for protocols, FTP would be the term for the least rubber option. There is nothing actually out there less safe than FTP. Depending on what you are doing with it, it might not matter. Simply it's the extreme limit of dangerous as these things go.

Based on your logic, I'd use SFTP, which is besides native to Windows, just is native to Linux and all other OSes as well. It'due south easier to use and a more universal standard. It meets your criteria meliorate than FTP while existence incredibly safe as a bonus.

2 of three establish this helpful thumb_up thumb_down
Assumes that MITM attacks on wired Isp links are commonplace. This is something that vested interests in encryption take been pushing like crazy, but there is little bodily evidence for such attacks.

If you lot are using public Internet connections and so that is a different matter, of course.

0 of 5 found this helpful thumb_up thumb_down
ianmacdonald3 wrote:

Assumes that MITM attacks on wired ISP links are commonplace. This is something that vested interests in encryption have been pushing like crazy, merely there is footling actual testify for such attacks.

If you are using public Internet connections then that is a dissimilar matter, of course.

I think information technology'due south better to say "don't use it at all" than "don't use it on public connections" - people forget also fast, that they are on a public connection and some even don't sympathize when they are on a public or private connection. Once you teach them to use FTP, many forget, that there was also something chosen SFTP or FTPS - actually many might retrieve information technology'due south withal, just these IT weirdo's can't agree on the right name....

Was this post helpful? thumb_up thumb_down
We dont fifty-fifty allow the port out of the firewall...

In fact we dont allow anything other than http out that uses articulate text passwords

1 found this helpful thumb_up thumb_down
JoeWilliams wrote:

What are you using it for?

If y'all're anonymously downloading images from mirror sites, and so fine.

If it's annihilation you demand to log in for, and you lot're not encrypting it in some way, then behave as though the system is compromised.

Information technology's likewise worth doing an MD5 check on the downloaded file to make sure information technology's non corrupt - or tampered with.

Was this mail helpful? thumb_up thumb_down
Mealy58

This person is a verified professional.

Verify your account to enable IT peers to encounter that you are a professional.

habanero

Are you using FTP to send receive confidential bank info or store your music library?

Is information technology secure no, the big question is does it thing?

ane of 3 found this helpful thumb_up thumb_down
I've but been looking at FTP and seen these videos

https://world wide web.youtube.com/picket?v=T0en_YfGNXQ

https://www.youtube.com/watch?v=ZxClPoiXyPU

Looks adequately easy to exploit vulnerabilities in FTP but I don't know how much of an effect that is, information technology would be adept to know?

Was this post helpful? thumb_up thumb_down
My vote goes for SFTP

Was this mail helpful? thumb_up thumb_down
Craig Weston wrote:

Looks adequately easy to exploit vulnerabilities in FTP merely I don't know how much of an result that is, it would be good to know?

Depends on the vulnerability simply whatever exploitable vulnerability is bad.

Was this post helpful? thumb_up thumb_down
SFTP hither, user, cert, pass.

Oh the days of bearding FTP! =)

0 of 1 found this helpful thumb_up thumb_down
I call up you already get the thought that FTP is not secure and that FTPS (FTP with TLS) or SFTP (SSH based) are preferred because of the added encryption. An aggressor on your network, or sitting between you lot and the FTP server (MITM or man-in-the-heart) can sniff the user/countersign. If you've treated FTP as a "skilful plenty" manner to admission files, I'd be concerned well-nigh your FTP server patching.

A nmap scan tin reveal what FTP server and version you are running, which could give an assaulter a vulnerability to exploit to own that box. That takes very little effort and with tools like Metasploit the technical difficulty is very low. Once an attacker has compromised your FTP server, their power to pivot into other systems depends on your network. Does the FTP sit on a DMZ without being part of your domain, or do you port frontward to a domain joined server?

The security poverty line on this is pretty low. The tools to compromise your FTP server are freely available, easy to use and can be washed in a few minutes.

two found this helpful thumb_up thumb_down
Not safe. Non safe at all.

Was this post helpful? thumb_up thumb_down
If you aren't strong encrypting the data you send over FTP prior to sending it, it's in the current of air. That elementary.

Either encrypt the data prior to send, or utilise SFTP (SecureFTP) via WinSCP or something similar.

1 found this helpful thumb_up thumb_down
I say no, as SFTP (SSH-File Transfer Protocol) it'due south very simple to setup (information technology's mainly SSH with an actress couple of things to setup) and likewise allows encryption on credentials and files, so it's way secure and not that hard to setup.

FTP I may only think to use information technology on a internal network if I am lazy and I don't desire to setup SMB or NFS. then long story short don't use FTP.

Well maybe if you don't care well-nigh the integrity of the files transfered or the credentials you use to become to the server y'all can utilise FTP

Was this post helpful? thumb_up thumb_down
How unsafe you say? Russian Roulette without removing any bullets from the chamber :) In this day and age, impale off everything that doesn't do encryption and disable all plain auth methods everywhere. It is a lot of piece of work, only you'll be doing it anyway, so only get on the train early :)

one constitute this helpful thumb_up thumb_down
if y'all want something good, consider CompleteFTP. Is for Windows, Runs on pure .NET, and supports multiple protocols for file transfer; y'all could utilize FTPS, SFTP, HTTPS, or HTTP if you so felt like it.

0 of 1 constitute this helpful thumb_up thumb_down
Delight don't forget, that FTP is non the only service/protocol out there, users should never employ on the WAN side of the network and avoid using on the internal side.

The often used telnet, pop3, imap, http and fifty-fifty smtp may expose passwords in plain text. Whenever this authentication is linked to some domain authentication (LDAP, ActiveDirectory, Radius,....) and no second cistron is used for all services, the consummate network is at danger to be abused.

Whatever password collected in plaintext will be reusable for other more secure services, making their protection useless. An assaulter simply has to run nmap against your public IP to find out what doors he can open to your kingdom with the username and pass nerveless from a plaintext authenticated session.

All of these services have today secure options. Configure and use them inside and outside your network. And only disable the unsecure services.

Was this postal service helpful? thumb_up thumb_down
IPFOUR

This person is a verified professional.

Verify your account to enable It peers to see that you are a professional.

serrano

Craig Weston wrote:

I've only been looking at FTP and seen these videos

Looks fairly easy to exploit vulnerabilities in FTP but I don't know how much of an outcome that is, information technology would be adept to know?

Ah nmap, my old friend

Was this post helpful? thumb_up thumb_down
Wow, thanks for all of the responses!!! Definitely wasn't expecting that!

So, we have a wildcard document. If I set up SFTP, can I even so use the native windows FTP customer?

- Jaapyse

Was this post helpful? thumb_up thumb_down
Seydon

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

tabasco

Jaapyse wrote:

Wow, thanks for all of the responses!!! Definitely wasn't expecting that!

Then, we have a wildcard certificate. If I set SFTP, can I still apply the native windows FTP customer?

- Jaapyse

The native windows FTP client (command prompt) doesn't support encryption at all...

If yous use SFTP (FTP over SSH), you lot'll need a real FTP customer (major ones, even costless ones support that). Same goes for FTPS (FTP with TLS)...

ane found this helpful thumb_up thumb_down
What security, there is no security whatsoever and the worst part is your credentials travel through the large bad cyberspace in clear text.

In case where the credentials only used for this access and there is no other college access level given to those credentials, except for the datas in the ftp share itself, and then your not in a bad position. But those datas are vulnerable.

In example where the credentials are used elsewhere or take higher access than simply the ftp share, you take a big password modify job to do right at present!

I recommend using a password storage app and give complexe unique password for each business relationship, at least for wathever is attainable on the wicked wild web..

Was this postal service helpful? thumb_up thumb_down
Seydon wrote:

The native windows FTP client (command prompt) doesn't support encryption at all...

If you use SFTP (FTP over SSH), you'll need a real FTP customer (major ones, even free ones support that). Same goes for FTPS (FTP with TLS)...

So, how do I safely get files to a server with Hyper-5 cadre installed on it?
There's no browser to download a real FTP client, and I don't wanna run an FTP server solely for the distribution of browsers to Hyper-V core servers.
You can't employ repositories like in Linux.

What options do I have left?

Was this mail helpful? thumb_up thumb_down
Setup a Spiceworks server with the AlienVault plugin simply run into how many deny hits you become on the FTP server...information technology's pretty scary!

I've setup SFTP (FTP over SSH, not to exist confused with FTPS, which is essentially HTTPS FTP) with CoreFTP Server and information technology'southward super simple. I'd practise that, personally.

Was this post helpful? thumb_up thumb_down
What is this AlienVault plugin you speak of?

Was this post helpful? thumb_up thumb_down
WTF FTP USE SFTP

0 of 1 found this helpful thumb_up thumb_down
Interesting, and I can agree that file transfer protocol is likely set up to become relic of a former fourth dimension. I'm curious about a few other alternative solutions one such equally being the employ of SharePoint sites inside ones own Role 365 surroundings as a new kind of FTP site.

Was this post helpful? thumb_up thumb_down
lol please take information technology back to where it came from!!

0 of one institute this helpful thumb_up thumb_down
There's 50+ analogies I could use, just it is absolutely not safety. FTP is like driving recklessly without a seatbelt of helmet on. No encryption on it is the worst offense.

Was this post helpful? thumb_up thumb_down
EdT wrote:

It's just bad. It'southward a instance of "Hey, the 80'south just chosen; they desire their insecure protocols back..."

Just like telnet!

and fax machines!

Was this post helpful? thumb_up thumb_down
If you must utilize FTP as is, at to the lowest degree use it through a VPN IPSEC tunnel.

Was this post helpful? thumb_up thumb_down
If your goal is to allow random strangers to recall files anonymously over the net, FTP is perfectly safe, it does this very well.

Was this post helpful? thumb_up thumb_down
mberna

This person is a verified professional person.

Verify your account to enable It peers to run across that you are a professional person.

chipotle

I would recommend filezilla. It'south a lightweight open source client that works with SFTP, FTP, and FTPS. Then, employ SFTP or FTPS rather than FTP.

Probably the worst thing I've seen in my IT experience is a VOIP visitor that would send recorded conversations, some of which probably contain credit menu data over unencrypted FTP.

Was this post helpful? thumb_up thumb_down
Consider to encrypt information before transfer to ftp as a good exercise

one found this helpful thumb_up thumb_down
I had an installation that was in such an isolated surroundings that in that location was no high speed internet. The just connexion was dial upward. And THAT connexion was and so poor that email took forever. Even so, and ftp worm is a very patient animal. It took a long time for the minor script to download and execute but when information technology finally did the server was toast. Not SECURE. I was not the Sysadmin only did become the job of running a forensic analysis of the server and getting it back on line. That is how I discovered what took it down. All of the posts in a higher place look correct, I but idea you might like an actual incident.

Was this post helpful? thumb_up thumb_down
Jaapyse wrote:

So, how practise I safely get files to a server with Hyper-Five cadre installed on information technology?

At that place's no browser to download a real FTP client, and I don't wanna run an FTP server solely for the distribution of browsers to Hyper-V core servers.
You can't use repositories similar in Linux.

What options practise I have left?

If you're on the same local network as the server you lot can use \\servername\c$ to get to the files.

CoreFTP also has a gratuitous mini SFTP server that I've used and it works quite well.

http://www.coreftp.com/server/

Their client is overnice too. Information technology's what I utilize to connect to my SFTP servers.

http://www.coreftp.com/

For command line use try psftp.

https://www.chiark.greenend.org.united kingdom of great britain and northern ireland/~sgtatham/putty/latest.html

1 institute this helpful thumb_up thumb_down
Seydon

This person is a verified professional person.

Verify your account to enable It peers to run across that you are a professional person.

tabasco

Jaapyse wrote:

Seydon wrote:

The native windows FTP client (control prompt) doesn't support encryption at all...

If you employ SFTP (FTP over SSH), you'll demand a real FTP client (major ones, fifty-fifty free ones support that). Same goes for FTPS (FTP with TLS)...

And then, how practise I safely go files to a server with Hyper-V core installed on it?
There's no browser to download a real FTP client, and I don't wanna run an FTP server solely for the distribution of browsers to Hyper-V cadre servers.
You can't utilise repositories similar in Linux.

What options exercise I have left?

Euh... the client should run from your computer, not the hyper-v server... Now, I practice not know hyper-five enough, but there should be a way to enable ftps (this is supported by IIS, then must be by hyper-v core equally well)..

0 of 1 establish this helpful thumb_up thumb_down
CrashFF

This person is a verified professional.

Verify your business relationship to enable Information technology peers to see that y'all are a professional.

habanero

SFTP is much easier to secure through a firewall because it uses one port for everything. FTPS uses one port for commands and login, and then opens up an additional random port for file transfers. because of this, SFTP speeds tend to be slower than FTPS because of the embedded control, encryption and handshaking overhead that are all washed over the single port used. Both FTPS and SFTP have a much lower overhead than HTTPS, making both options a faster alternative. I endeavour -not- to recommend anything HTTPS for file transfers if you can help it when it comes to large file transfers, either in number, or in byte-size.

I notice the only benefit of an HTTPS upload/download is the user interface is web based accessibility to the stop user, which in many cases wins out because BFU..

Was this post helpful? thumb_up thumb_down
TagYourIT wrote:

WTF FTP Apply SFTP

hmm.. aye.. then.. I recognize the bad "FTP" protocol, the expert "SFTP" protocol, non sure nearly the "Apply" protocol..

.. and what is the "WTF" protocol for??

Was this post helpful? thumb_up thumb_down
Years ago, one of my friends ran an FTP server on his home machine/server. He logged into it ane day to detect that there were new folders that he couldn't get into and couldn't delete. Someone had gained access and set up an account, created files and locked him out of it. He concluded upward shutting the machine downward and rebuilding information technology with a more secure solution.

Was this post helpful? thumb_up thumb_down
Jaapyse wrote:

And so, how do I safely get files to a server with Hyper-V core installed on information technology?
There's no browser to download a existent FTP client, and I don't wanna run an FTP server solely for the distribution of browsers to Hyper-V core servers.
You can't use repositories like in Linux.

What options practise I accept left?

See #2: https://community.spiceworks.com/topic/254525-asking-better-questions

What are you trying to practise here?

I only use the administrative share to transfer files to/from my Hyper-5 Servers (the less-than-core free hypervisor only).

1 institute this helpful thumb_up thumb_down
linksep wrote:

Jaapyse wrote:

So, how do I safely get files to a server with Hyper-V core installed on it?
At that place's no browser to download a existent FTP client, and I don't wanna run an FTP server solely for the distribution of browsers to Hyper-V core servers.
You can't employ repositories similar in Linux.

What options do I accept left?

See #ii: https://customs.spiceworks.com/topic/254525-asking-better-questions

What are you trying to do here?

I only use the authoritative share to transfer files to/from my Hyper-5 Servers (the less-than-cadre costless hypervisor only).

I'll second this. It might be more helpful if yous tell usa exactly are you trying to do and why? I'1000 not a HyperV user myself, but if it'south setup like other virtualization platforms, it is intended to be managed entirely with remote tools. The console really only exists for recovery purposes. Within a M$ environs the native SMB shares are almost always one of the best options for file transfers.

ane found this helpful thumb_up thumb_down
If security is the overall concern I would consider Titan SFTP. Its amend than your run of the mill Sftp software as information technology has all the usual suspects including HTTPs. Simply, where information technology really excells is all the anti Hack security under the bonnet. I accept used it for over fourteen months and information technology has been an like shooting fish in a barrel setup and worry free motoring. In the time it's been up information technology has blocked and banned over 9295 IPs &bots. The 'Effect' handlers are especially good and useful for tailoring your security needs. Support is very good besides. Works well with all clients only we prefer FileZilla over others.

Was this post helpful? thumb_up thumb_down

Read these next...

Snap! Tarrask, ZLoader's botnet, RaidForums raid, G2 tempest lookout man, & The Northman
Spiceworks Originals
Your daily dose of tech news, in brief. Fri is right effectually the corner! You demand to hear this. Microsoft: New malware uses Windows bug to hide scheduled tasks It feels like every day we're reporting nigh a new malware attack which is p...
Is my (nonexistent) squad too pocket-sized?
Best Practices & General It
I piece of work in a semi unique environment - nosotros accept almost 65 employees that are full time tied to their computer, accounting, Hour, etc. from anywhere betwixt 5 am and seven pm almost of the year, sometimes that stretches to four am to 10 pm though. Monday through Friday ...
Bizarre File Extension (MIME)
Software
Hey all,A user sent me a file with a .mime extension, which I'd never seen earlier in my life. All Google searches involving .mime files announced to turn upwards Multi-Purpose Internet Postal service Extensions, but their description leads me to believe that information technology isn't a fil...
Spark! Pro series - 14th April 2022
Spiceworks Originals
Today in History: 1965 Abraham Lincoln is shot President Abraham Lincoln is shot in the head at Ford'due south Theatre in Washington, D.C. on April 14, 1865. The assassinator, actor John Wilkes Booth, shouted, "Sic semper tyrannis! (E'er thus to tyrants!) ...
Metadata Scrubber for Microsoft Office and PDF's
Deject Calculating & SaaS
I am looking for a good metadata scrubber for a law business firm - whatever suggestions? I know how to do it manually but they want something that works with Outlook - A plug-in that strips it out when they send emails. Whatsoever suggestions?