2

I'm not a sysadmin, in fact I have zero skills in this area.

However, I need to setup an FTP Server for the purpose of receiving uploads daily. The T1 will be connected to a router, and this will be the only box attached to that router.

Will Windows Vista, FTP Server on IIS be secure enough? I was thinking that all ports can be closed except for FTP. Or should I invest some time and build a linux box?

Thanks for all that can help,

Jason

6 Answers 6

5

The FTP Server itself is mostly fine, but keep in mind that FTP transfers the username and password in clear text, so any sniffer on the line can get it. But that's not a fault of the IIS FTP Server but rather of the FTP Protocol itself.

There are more secure alternatives (SFTP or SCP), but those require support by the FTP Client (and are not supported by IIS).

2

I like FTP over SSL or S/FTP (secure shell) better than FTP because they protect you from packet sniffers and also provide an assurance that the server is really the one you were intending to talk to.

You don't mention which version of IIS/Windows Server you have but FTP 7.5 for IIS7/Windows Server 2008 includes the abillity to do FTP over SSL. I really like WinSSHD from Bitvise for SFTP/SCP on Windows, too.

1

FileZilla Server, a Windows-only FTP server, is easy to use and configure, and allows you to create FTP users that are not real Windows user accounts. I haven't tried its SFTP features, but I know it supports that too.

0

Maybe it will be easier for you to go that way, and i think it will be secure enought. But it also depends how you want to manage the users accounts, some FTP servers (vsftpd, proftpd, pure-ftpd) provide mysql server support, also some OS are more geared towards security, the best option would probably building an OpenBSD box for that purpose.

0

Your answer depends on more details. Is the information to be transferred over FTP sensitive or confidential? Are people connecting anonymously, or supplying a username and password? If they are connecting anonymously and the information is not confidential, you needn't worry about encryption. (there are still other things to consider. How do you prevent third parties uploading other things to your site? Or at least, how do you mitigate such risks? One answer: anonymous users have write-only access: you cannot fetch files FROM the FTP server, just upload new ones.) Otherwise, you should look into encryption options. As Brian states, 2008 supports FTP-SSL.

0

If you go down the Linux route, ClarkConnect is a free easy to setup server with SFTP support.

You must log in to answer this question.