Securing FTP
| FTP, as you learned in Chapter 27, "Configuring an FTP Server," is another clear-text service that has inherent password authentication and therefore has the potential to be compromised by an attacker watching the wires. FTP is used frequently by users to do things such as uploading web pages, but it isn't used at predictable, regular intervals like POP3 or IMAP. This makes FTP a bit less risky to your system than Telnet, but still worth securing. Fortunately, secure FTP is just as easy to implement as SSH. If you've enabled SSH (as you learned to do in "Securing Terminal Traffic (SSH)," earlier in this chapter), secure FTP is available to your system. Encrypted FTP sessions actually operate over the SSH channel, with the SSH client establishing a terminal connection, starting the /usr/libexec/sftp-server program on the server end, and opening the necessary connections back to the client over encrypted channels. The secure FTP client then operates transparently to the user, just like a regular FTP program. On FreeBSD, the built-in sftp program that's a part of OpenSSH serves the purpose of handling the client end of a secure FTP session. On Windows, the SSH Communications Security package provides a secure FTP client that works with FreeBSD. The previously mentioned Mac OS clients (NiftyTelnet and MacSSH) also have secure FTP capabilities, and Mac OS X has the command-line sftp. Secure FTP isn't as configurable as regular FTP, and it doesn't use any of the standard configuration files that the built-in FTP server uses. Instead, you need to use the same configuration file for secure FTP as you would use for SSH: /etc/ssh/sshd_config (see man sshd_config for details). If, for example, you want to deny certain users access to FTP, you need to use the DenyUsers statement, which blocks specified users from accessing the system through secure FTP or SSH: DenyUsers frank joeNote Anonymous FTP is also not supported in the secure FTP model. However, because the major reason for encryption is to prevent the passwords of your system's login users from being exposed in clear-text, there really isn't much point to encrypting anonymous FTP, which has no passwords or linkage to your local users. Note Secure FTP (SFTP) is subtly different from FTPS, a similar solution for securing FTP traffic. Refer to http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html for details on the differences. An alternative way to perform file transfer over a secure channel is to use scp. This enables you to copy files to and from a remote server using login authentication, much in the same way that rcp works (see man rcp and man scp for details), except that scp operates via the encrypted SSH tunnel. To use scp to transfer a file from your local machine to a remote SSH server, use a command like the following: # scp file.txt stripes: frank@stripes's password: file.txt 100% |*****************************| 511 00:00The remote hostname is specified with a trailing colon (:) and can be either the source or destination argument. Either of these arguments can also contain full pathnames to the file's location (for example, scp file.txt stripes:public_html/textfiles). Using scp is a quick way to transfer files securely if you don't need all the features of full-fledged FTP. You can even perform recursive fetches, making scp a handy tool for transferring whole directory structures. |
