4

The site I manage has already suffered one major and one minor breach so I'm looking closely at methods of improving security. We've been using FTP...

Everybody seems to agree that FTP must be replaced for the sake of security, and SFTP seems to be the replacement. But our shared-hosting plan provides only one SFTP account and our primary alternative vendor only one.

I imagine that this is just what one gets being unable to afford better than shared hosting. But also because SFTP is SSH-based and there's no need to have lots of different people mucking about sites via SSH.

Q1: Do any major hosting vendors provide multiple secure accounts in shared-hosting plans at competitive prices?

Q2: Is it correct that there's no sensible way to share one SFTP account among two or three people? In other words, is it inevitable that someone will end up using a totally insecure FTP connection?

Q3: What to do? Suggestions welcome!

Q4: Am I missing anything incredibly obvious?

No, we were never able to determine the cause of the breaches, despite a lot of effort. I located as many lists of precautions to take and holes to close and did my best. FTP is one major one I'm still trying to close.

Briefly: After the first breach, we updated to the latest version of the CMS we use (phpFusion) and moved the bulk of the site to subdomains. (There is a good reason, not relevant here, to do that.) That left in the base domain only a trivial greeting--switching html page containing static links to CMS instances in the subdomains. The second breach inserted a lot of hidden links in that file. As far as I can see there was basically nothing to hack in the base domain, so hijacked FTP seems like the most likely means of access. FTP passwords were reasonably robust, so brute force seems unlikely.

By the way, tech support was unresponsive to our incident reports, and the vendor doesn't provide an FTP access log, which could confirm or rule out that someone sniffed FTP credentials.

--

There are only two of us with site root access. We're co-workers on a public-interest site, so both highly motivated to secure the site. I'm concerned that my colleague isn't very technical and doesn't have a lot to spend to protect his PC, so he may have picked up a keylogger.

There are only two of us with site root access. We're co-workers on a public-interest site, so both highly motivated to secure the site. I'm concerned that my colleague isn't very technical and doesn't have a lot to spend to protect his PC, so he me have picked up a keylogger.

Improve this question
3
  • Perhaps you should describe how many users you have, and what's the trust level? Are these co-workers? Clients? Do they need access to one siteroot per SSH user?
    – gravyface
    Sep 11, 2010 at 0:36
  • While the keylogger is possible it's not very likely. It's more likely the fact that you've both been using FTP, which transmits account names and passwords as plain text.
    – Cypher
    Sep 16, 2010 at 4:49
  • If not by keylogger, what is the most likely means by which our FTP sessions are sniffed and credentials harvested? If we must continue using FTP due to lack of multiple SFTP accounts, then it might be helpful to know how this works. I'm wondering if changing FTP passwords very frequently might offer some protection. What else might be done?
    – hen3ry
    Sep 17, 2010 at 22:25

3 Answers 3

Reset to default
2

Has the root-causes of the breaches been determined first and was determined to be a result of compromised logons (which may or may not be an indication of a hijacked ftp session)? Replacing ftp with sftp is definitely more secure, but is it actually addressing your past breaches (to keep you from being a repeat victim of the same vulnerability - which should be the first priority)?

Improve this answer
2
  • No, we were never able to determine the cause of the breaches, despite a lot of effort. I located as many lists of precautions to take and holes to close and did my best. FTP is one major one I'm still trying to close.
    – hen3ry
    Sep 15, 2010 at 23:50
  • The switch from FTP to SFTP will definitely address security situations where network traffic is being hijacked. It will do very little, if the actual security situation involves weak user practices or other breach vectors.
    – user48838
    Jul 6, 2013 at 2:20
1

FTP data (including login credentials) is transmitted in plain text, which is why it is so insecure. You definitely want to start making a habit of using SFTP as your data would be encrypted then.

Q1: Do any major hosting vendors provide multiple secure accounts in shared-hosting plans at competitive prices?

A1: Media Temple offers a way to create multiple users with access to SSH/SFTP in their "shared" hosting plan - they call it the Grid. http://mediatemple.net

Q2: Is it correct that there's no sensible way to share one SFTP account among two or three people? In other words, is it inevitable that someone will end up using a totally insecure FTP connection?

A2: This depends on what you want. If there are only two or three of you working together - then there really isn't much reason why sharing an account would be a problem. On a side note, depending on who you are working with and your trust level with these folks, you really want the ssh/sftp account that you are all sharing to NOT be a root/administrative user.

Q3: What to do? Suggestions welcome!

A3: If you trust your co-workers, there is no reason why you couldn't share a single ssh/sftp account. I do suggest that you disable FTP completely, if you can or at the very least disable FTP for that user. Since your site has already been compromised, also make sure all your passwords are changed. All of them: mysql, apache, root, and any other users or accounts.

Q4: Am I missing anything incredibly obvious?

A4: Watch out for sql injections, old versions of software: apache, phpmyadmin, mysql - keep those things up to date and always use SFTP or SSH to remote connect to your host. Change your passwords as often as reasonable for your work-style for all systems; database users, root, ssh accounts... etc.

Improve this answer
5
  • Thanks for suggesting Media Temple but it is too expensive for us. Though I personally trust my sole colleague, I think it is a big security hole to share the single full-access account with him. I'm also not sure the SSH credentials established for me will work on his computer, 8 time zones away.
    – hen3ry
    Sep 15, 2010 at 23:55
  • In general, I'm kind of shocked that everyone seems to agree that FTP should no longer be used, but support for a more secure protocol is minimal. Maybe this is just characteristic of low-cost shared hosting. How long before these vendors support multiple secure communications accounts? I'm not holding my breath.
    – hen3ry
    Sep 15, 2010 at 23:58
  • @ hen3ry: The credentials have nothing to do with time zones. It's simply a username and password... and you either trust your colleague or you don't. If you think giving your colleague your credentials to the server is a security hole, then it doesn't sound like you trust this person. :) The alternative to FTP is SFTP... or rather, FTP over SSH. If a paid hosting plan is too expensive, why not setup your own server in-house? There are plenty of free systems out there nowadays to help you deal with dynamic ips and dns so you can focus on your web server.
    – Cypher
    Sep 16, 2010 at 4:46
  • My colleague is very trustworthy, but really not technical, and so I think it is best to avoid giving him access to a unix shell. In-house? Seems like a lot of trouble to maintain, not a practical solution in the short run. But I've been curious about the possibility. Can you give me some links to how-to's? Thanks.
    – hen3ry
    Sep 16, 2010 at 17:59
  • Correction: "how-tos" only with respect to dealing with dynamic IPs. I have an Apache server running locally, no problem.
    – hen3ry
    Sep 16, 2010 at 18:56
0

If you're on shared hosting you typically pay for webspace for the domain, so you will get one SSH account which logs you into that one folder. SFTP just logs in using that account, and the restriction on how many accounts is most likely how many usernames - not how many concurrent connections.

If you have more than one domain, you will probably get more than one account. If you don't, why do you need more than one account? Also, see user48838's post, he's right, don't bother nailing a plank across the door if you've got an open window.

Improve this answer
1
  • In this tier of service, while typically one can create numerous (say up to 50) FTP accounts, I think there is only one fully-privileged user account supported.
    – hen3ry
    Sep 15, 2010 at 23:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .