2

I have a client that wants FTP access to a certain file on one of my servers. The server runs CentOS 7.

Root login is disabled. Password login is disabled (requires ssh key to login). SSH is on a non-standard port.

Is giving the client FTP access to the file feasible? I feel like I have followed all "best practices" to secure the servers, and FTP seems like it may undermine some of this.

Am I missing something here? Will we have to figure out a different approach to maintain security?

  • Is this ftp or sftp via SSH? – thrig Sep 28 '15 at 23:30
  • @thrig the system has not yet been configured, I am looking for the best way to implement it. I may be able to say sftp only – Brian Leach Sep 28 '15 at 23:43
4

FTP is feasible, but should only be used when no other option is possible (ie interacting with an IBM mainframe where SSL/SCP/SFTP is not available). FTP also sends passwords in cleartext, so any malicious parties snooping the traffic would easily get the login credentials.

If you absolutely MUST use FTP, use an account that has no access to anything else on the system, but if it's at all possible, use sftp instead. Using ssh keys would alleviate the need for a password with sftp, if necessary.

0

You might want to consider using an FTP server software to provide this function. For my experience, ProFTPd is a good choice, as it provides a virtual user mechanism which cannot do any shell commands on the system. You can provide SFTP service with ProFTPd (of course it must be on a different port with SSH).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.