<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Thanks guys,<div><br></div><div>Just one point though - Michael - you seem to have lumped SFTP/FTPS/mod_sftp) all in to the same bracket - and then refer to FTP over SSL as something else. FTPS *IS* FTP over SSL!</div><div><br></div><div>So to clarify:</div><div><br></div><div><b>FTPS = FTP over SSL (Explicit or Implicit)</b></div><div><br></div><div>Just like HTTPS is HTTP over SSL. Uses SSL/TLS & x.509 certs for authentication. Not so firewall friendly (required 2nd data channel). Not as client compatible as SFTP. Communication can be 'logged' for session diagnostics.</div><div><br></div><div><b>SFTP = SSH File Transfer Protocol. </b></div><div><br></div><div>Uses SSH keys. No session logging. More client compatible than FTPS</div><div><br></div><div>You then go on to say that SFTP / FTPS all send data in the clear - hmm - not sure about that either!</div><div><br></div><div>FTPS (FTP over SSL) has both a COMMAND channel (for authentication) and a separate DATA channel - so it is FTPS *not* SFTP which can enable you to encrypt the command / authenticate part of the communication (via AUTH TLS or AUTH SSL commands) and the DATA channel (PROT). So with FTPS you can have COMMAND encrypted and DATA in the clear. </div><div><br></div><div>There is actually a lot to be said for using FTPS with secure COMMAND and unencrypted DATA channel. If you are using high end security scanning equipment - NIDS etc, these devices are unable to 'see' inside encrypted traffic - so someone can upload a virus / trojan no problem at all. By using SSL/TLS for the COMMAND phase only, you keep passwords secure, but can examine and block vulnerable or suspicious content. </div><div><br></div><div>I am still interested to learn more about this mod_sftp module - I'm not sure it's behaviour mirrors that of full blown SSH - if it did - I agree there would be no point to run this.</div><div><br></div><div>Cheers,</div><div><br></div><div>Jeff</div><div><div><br></div><div><br></div><div>On 9 Nov 2010, at 01:40, Michael Stauber wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Hi Jeff,<br><br><blockquote type="cite">This is a teeny bit off topic, but how about BX using proftp with mod_sftp?<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Using this would mean you get full secure file transfer, plus, unlike using<br></blockquote><blockquote type="cite">OpenSSL for ssh / sftp, you don't have to worry about giving shell access,<br></blockquote><blockquote type="cite">jails etc.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Some clear instructions here:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><a href="http://www.directadmin.com/forum/showthread.php?t=30607">http://www.directadmin.com/forum/showthread.php?t=30607</a><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Any see any reason why this method would not work with BX? How tricky would<br></blockquote><blockquote type="cite">this be to build in?<br></blockquote><br>Chuck Tetlow posted a reply which pretty much outlines why we don't do that:<br><br>You'd have to have SSH and/or shell access enabled for the respective <br>accounts, which opens a whole new can of worms security wise.<br><br>There are different methods available for securing FTP. <br><br>One of them is supported on BlueOnyx out of the box:<br><br>- Secure FTP (SFTP/FTPS/mod_sftp) <span class="Apple-tab-span" style="white-space:pre"> </span><- NOT SUPPORTED<br><br>- FTP over SSL <span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span><- SUPPORTED in BlueOnyx (out of the box!)<br><br><br>1.) Secure FTP:<br><br>Secure FTP transmits the authentication dialogue between FTP client and server <br>in an encrypted SSH session. However, the actual data transfer is handled <br>through an unencrypted regular FTP session and is submitted "in the clear".<br><br>2.) "FTP over SSL":<br><br>Opposed to "Secure FTP" the FTP session itself gets encrypted - without <br>sending all the data over a separate SSH connection. Instead the control <br>channel *and* the data-channel of the FTP session are encryped through SSL or <br>TLS. Even server to server FTP connections (FXP) can be encrypted via SSL/TLS, <br>which is not yet possible with "Secure FTP". Thanks to "FTP over SSL" it is <br>now possible to completly encrypt a passive FTP session. If active FTP is <br>used, then it's possible to use "implicit SSL", which immediately allows to <br>start the session encrypted without first issuing "AUTH SSL" or "AUTH TLS" <br>through an unencrypted plain text command during the startup of the <br>connection. <br><br>FTP over SSL also works if no SSH connection is allowed or if the FTP user has <br>no shell assigned. The only requirement is that the user is allowed to login <br>by FTP and that he is not suspended.<br><br>FTP clients that support "FTP over SSL":<br><br> * Cyberduck: (Mac OS X (GPL))<br> * FlashFXP: FTPS client (Win32)<br> * FileZilla: SFTP & FTPS client (GPL) <br> * FireFTP: Firefox-Extension for FTP and FTPS (since Version 0.96.4) <br> * lftp: FTPS cli based FTP client (Unix (GPL))<br> * PSFTP: sFTP & FTPS client (Win32)<br> * SmartFTP: sFTP & FTPS client (Win32)<br> * Speed Commander: (Shareware)<br> * Total Commander <br> * WISE-FTP: sFTP & FTPS Client for Windows<br> * coreFTP: sFTP & FTPS Client for Windows<br> * WinSCP: sFTP & FTPS & SCP Client for Windows (FTPS since version 4.2)<br><br><br>-- <br>With best regards<br><br>Michael Stauber<br>_______________________________________________<br>Blueonyx mailing list<br><a href="mailto:Blueonyx@blueonyx.it">Blueonyx@blueonyx.it</a><br>http://www.blueonyx.it/mailman/listinfo/blueonyx<br></div></blockquote></div><br></body></html>