Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Suppose I have a text file with confidential information. I want to transfer from American facility to the france facility via sftp set up in a website.

Is the file transfer secure?

share|improve this question

migrated from stackoverflow.com Sep 11 '11 at 20:57

This question came from our site for professional and enthusiast programmers.

2  
What, exactly does "sftp set up in a website" mean? –  freiheit Sep 11 '11 at 21:07
1  
If in doubt why not simply use any one of the myriad available methods to encrypt the data? –  John Gardeniers Sep 13 '11 at 23:18

5 Answers 5

In day-to-day work, I'd be comfortable transferring unencrypted data via SFTP. The transport protects it.

With FTP, regardless of whether the data is encrypted or not, you just shouldn't use it. FTP doesn't encrypt the authentication details. The username and password is transmitted in plaintext, and you end up compromising your account info.

share|improve this answer

While SSL and TLS differ in ways that make them inoperable with each other, they are generally considered equal in terms of security. The main difference is that, while SSL connections begin with security and proceed directly to secured communications, TLS connections first begin with an insecure “hello” to the server and only switch to secured communications after the handshake between the client and the server is successful. If the TLS handshake fails for any reason, the connection is never created.

If you use Windows (like I do) , this being the case, instead of a FTPS server (such as FileZilla), you probably just want a SFTP capable, non-TLS, server (which is based on SSH) such as NULL FTP Server or what I use: WinSSHD with Tunnelier client.

share|improve this answer
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.IO;
using System.Security.Cryptography;

namespace Encryption
{
    class Program
    {
        static void Main(string[] args)
        {
            EncryptFile(@"C:\a.txt", @"C:\b.txt","password");
            DecryptFile(@"C:\b.txt", @"C:\decrypted.txt",@"password");
        }
        public static void EncryptFile(string inputFile, string outputFile,string password)
        {

            try
            {

                UnicodeEncoding UE = new UnicodeEncoding();
                byte[] key = UE.GetBytes(password);

                string cryptFile = outputFile;
                FileStream fsCrypt = new FileStream(cryptFile, FileMode.Create);

                RijndaelManaged RMCrypto = new RijndaelManaged();

                CryptoStream cs = new CryptoStream(fsCrypt,
                    RMCrypto.CreateEncryptor(key, key),
                    CryptoStreamMode.Write);

                FileStream fsIn = new FileStream(inputFile, FileMode.Open);

                int data;
                while ((data = fsIn.ReadByte()) != -1)
                { 
                    cs.WriteByte((byte)data); 
                }


                fsIn.Close();
                cs.Close();
                fsCrypt.Close();
            }
            catch(Exception e)
            {
                Console.WriteLine(e);
            }
        }

        public static void DecryptFile(string inputFile, string outputFile,string password)
        {

            {


                UnicodeEncoding UE = new UnicodeEncoding();
                byte[] key = UE.GetBytes(password);

                FileStream fsCrypt = new FileStream(inputFile, FileMode.Open);

                RijndaelManaged RMCrypto = new RijndaelManaged();

                CryptoStream cs = new CryptoStream(fsCrypt,
                    RMCrypto.CreateDecryptor(key, key),
                    CryptoStreamMode.Read);

                FileStream fsOut = new FileStream(outputFile, FileMode.Create);

                int data;
                while ((data = cs.ReadByte()) != -1)
                    fsOut.WriteByte((byte)data);

                fsOut.Close();
                cs.Close();
                fsCrypt.Close();

            }
        }

    }
}
share|improve this answer
    
I used this to encrypt it. Thanks for your help! –  hidden Sep 13 '11 at 22:54

As Davide Piras pointed out SFTP or more precisely the underlying SSH protocol can be quite secure.

But if I understood you correctly you want to use some kind of web-based SFTP client. That means that you also have to secure the connection between your client and the web-site you're using to transfer the file.

Rather than trying to get transport security right (which you should do none the less) you should encrypt the data itself (e. g. with PGP or GnuPG), transfer that encrypted file and finally decrypt it on the target system.

share|improve this answer
    
That's what I told my co-workers –  hidden Sep 13 '11 at 22:52

From the wikipedia article: SSH File Transfer Protocol

The protocol itself does not provide authentication and security; it expects the underlying protocol to secure this. SFTP is most often used as subsystem of SSH protocol version 2 implementations, having been designed by the same working group. However, it is possible to run it over SSH-1 (and some implementations support this) or other data streams. Running SFTP server over SSH-1 is not platform independent as SSH-1 does not support the concept of subsystems. An SFTP client willing to connect to an SSH-1 server needs to know the path to the SFTP server binary on the server side.

so it really depends on the way you set this up.

Read the whole article if you are interested.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.