I have a client that wants FTP access to a certain file on one of my servers. The server runs CentOS 7.
Root login is disabled. Password login is disabled (requires ssh key to login). SSH is on a non-standard port.
Is giving the client FTP access to the file feasible? I feel like I have followed all "best practices" to secure the servers, and FTP seems like it may undermine some of this.
Am I missing something here? Will we have to figure out a different approach to maintain security?
FTP is feasible, but should only be used when no other option is possible (ie interacting with an IBM mainframe where SSL/SCP/SFTP is not available). FTP also sends passwords in cleartext, so any malicious parties snooping the traffic would easily get the login credentials.
If you absolutely MUST use FTP, use an account that has no access to anything else on the system, but if it's at all possible, use sftp instead. Using ssh keys would alleviate the need for a password with sftp, if necessary.
You might want to consider using an FTP server software to provide this function. For my experience, ProFTPd is a good choice, as it provides a virtual user mechanism which cannot do any shell commands on the system. You can provide SFTP service with ProFTPd (of course it must be on a different port with SSH).
ftporsftpvia SSH? – thrig Sep 28 '15 at 23:30sftponly – Brian Leach Sep 28 '15 at 23:43