Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Just thought this may be an issue, since we do not want to expose user passwords that can give full access to remote desktop etc.

Does windows protect the password at all?

Thanks

share|improve this question
    
Which protocol you are talking about? FTP? –  Khaled Nov 1 '10 at 9:19

1 Answer 1

up vote 3 down vote accepted

Well yes, I believe it doesn't protect the password in a FTP session. The FTP Protocol defines clear text for username and password info, so any FTP server and any FTP client will expect passwords to be sent in clear text in order to adhere to the standard. If Microsoft were to change that then it wouldn't be a FTP server any more.

This is a weakness in the FTP protocol (actually in fairness it's less a weakness and more a reminder that several internet protocols were designed in kinder gentler days when security was less of a pressing issue than it is now) that Microsoft or any other vendor has very little choice about.

It's documented reasonably clearly here if you fancy a read but I've included the most relevant extract below:

Note: Due to the design of File Transfer Protocol (FTP), user names and passwords are transmitted over FTP in plain text, making them vulnerable to network discovery. It is therefore recommended that you use Basic authentication with SSL.

I suggest the same as them, FTP over SSL. Also consider not using domain accounts for FTP access; we've setup local accounts on the FTP server for employees and students who require FTP accounts.

share|improve this answer
1  
+1 Another option is to use SFTP (Secure FTP - Uses SSH) - but that is not built into Windows and requires third-party software. –  Dan Nov 1 '10 at 11:48
1  
Secure FTP (FTPS) and SFTP are not the same thing. –  Keith Stokes Nov 1 '10 at 12:05
    
Thanks, just wanted to clarify that. –  gb2d Nov 1 '10 at 12:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.