Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a rackspace hosted debian instance and need to copy sensitive files up to it. I'm thinking of setting up an ftp server but have concerns about security as i believe credentials are passed in plaintext? Is there an ftps i can use? Any other options to move files over the internet securely?

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

Do you have a SSH server on this system ? If yes, you can use it to connect to your system using sftp protocol, which is basically FTP commands over SSH. And there is no need for another user database, just reuse the one you use for SSH. As a SFTP client, I like filezilla.

If not, vsftpd (an excellent FTP server) can be configured to enable FTP over SSL. You will need a self-signed certificate and change a few parameters in vsftpd.conf (such as ssl_enable=YES).

Also, if you know you will connect to this FTP server from one IP address only, you could add an firewall rule (iptables/netfilter) to allow connections from this IP only.

share|improve this answer
    
this is perfect - thanks! not sure i'll restrict to one ip. i am using filezilla (i use it for ftp all the time) - are my credentials transmitted securely? or do they go in plaintext? For server type in the filezilla interface i chose "SFTP - SSH File Transfer Protocol" –  Tone Sep 12 '10 at 22:14
    
Throught SFTP, your credentials and all of the data of the connection are transmitted securely. If you don't mind a bit a technicalities, take a look at the wikipedia page: en.wikipedia.org/wiki/Secure_Shell –  Julien Vehent Sep 13 '10 at 6:21
add comment

if you can ssh into your machine, you can sftp in, tools like Transmit, Cyberduck,, WinSCP, Filezilla all have support for it, you just connect to port 22 like SSH, and you keep the FTP type interface you're used to.

one addition to Julien's answer, if you aren't comfortable with iptables and only allowing access from one ip using that, you can use tcpwrappers, edit your /etc/hosts.allow and /etc/hosts.deny

share|improve this answer
add comment

Using ssh/scp/sftp is the best guess.

But I would consider an encrypted filesystem too.

You have at least two critical points:

  • transmission and authentication
  • storage on your server (you can get hacked on any other running service too...)

Encryption can be done as

Filesystem encryption:

  • Loop-aes
  • dm-crypt
  • ...

You can find more here: http://www.debianadmin.com/filesystem-encryption-tools-for-linux.html

File based encryption

  • gpg (http://www.cyberciti.biz/tips/linux-how-to-encrypt-and-decrypt-files-with-a-password.html)
  • ccrypt (http://sourceforge.net/projects/ccrypt/)
  • ...
share|improve this answer
    
can you expand a bit on your experiences with "encrypted file system" in linux? I am intrigued... –  Tone Sep 12 '10 at 22:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.