0

I need the ability for clients to send me files. I would like them to use web services, but they are unable to do this (they want to just FTP a file over like they are used to, so this is what I have accepted).

I run Windows servers but am a little skeptical about housing an FTP server in my network with my app servers/DB servers since I am aware of the security issues surrounding an FTP server.

What is the best way to deal with this?

Improve this question
1
  • Remote services like cjc suggested are one way. The other is to vlan isolate an FTP box on your side and just firewall it off from anything except accepting FTP connections from your desktop machines and the outside world.
    – Jeff Ferland
    Mar 9, 2012 at 16:16

5 Answers 5

Reset to default
1

The issue with FTP server is that mainly its unencrypted, you would ideally want to install an SSL certificate to ensure you are protected. Also as having strong passwords for all accounts on the FTP server is important.

If you are still worried, use a 3rd Party FTP server such as Filezilla's: http://filezilla-project.org/download.php?type=server

You can then have a very limited set of users and just start and stop the service for when it is needed.

Improve this answer
1
  • Alternatively there are many 3rd party applications both Open Source and Proprietary that implements sftp for windows
    – proy
    Mar 9, 2012 at 17:31
1

You can set a FTP on, say, a VPS or EC2 instance far, far away from your network and tell them to put the files there. After they upload, you can go fetch them yourself. That way, they have FTP/SFTP, and that service is separate from your own network. An EC2 Micro instance runs around $15/month, plus whatever you'd need for storage if you attach an EBS to it. You can spin the EC2 instance up when you need it, if the transfers don't happen that often.

Improve this answer
0

Have a look at CrushFTP The install is simple and you can enable many different protocals. We use HTTPS and it works very well. Too many features to list here but very resonably priced and support is great. Free trial as well. You can brand the site with your logos. It also has great security and will ban attacks like dictionary attacks and alert you.

Really works well for us and users simply need a browser.

Improve this answer
0

Security issues on FTP servers are primarily related to clear-text passwords on the wire.

I see here three possible solutions to this issue:

  • Webdav with SSL. Can be used with some FTP clients, web browsers should work fine also. Lot of authentication methods, can run on a webserver (thus eliminating the need of a separate daemon).

  • FTPS: FTP over SSL. Server certificate for encryption, optional client certificate for authentication. Servers have also a lot of user auth methods: database, local users, ldap...

  • SFTP: FTP over SSH. Also compatible with some FTP clients. ssh auth options available. passwords, ssh keys... May not be windows friendly however (server-side).

Improve this answer
0

It's kind of interesting that people are so stuck in their mind that they still want to use FTP.

FTP is a prehistoric protocol that was never designed for secure communication.

What about providing a secure web file manager where the users can simply drag and drop multiple files directly into the browser?

Or use a secure WebDAV server, where the users can map the far side server as a Windows disk?

Take a look at BarracudaDrive, which provides a solution to the two above mentioned uses cases.

http://barracudaserver.com/products/BarracudaDrive/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .