Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a number of various FTP processes, running on various internal servers, that connect with outside vendors to send or receive sensitive data files. As such, we don't have one centralized place to keep track of these processes and log what files are being transferred. At the same time, we're worried about staff sending unapproved files to outside organizations without us knowing about it. And for those vendors that push files to us, we'd prefer in the future that they not be allowed into our network, even if solely via FTP. To address these concerns, we're considering a solution with two primary goals:

  1. Centralize all FTP transmissions so that they are all handled from one place that is easily monitored.
  2. Block all ports in our firewall that allow FTP and SFTP communication.

This is what we are planning: we'll put an SFTP server in our DMZ to interact with our vendors, so that they never need to go through our firewall in the future. Then, we'd have a web service set up on both the DMZ and an internal server that will send the files to each other through our firewall over TCP/IP using SSL.

I'd like others' thoughts on this idea, namely:

  1. Is this idea feasible and secure? Or is there a flaw in it that may be giving us a false sense of security?
  2. Are there any software packages out there that you would recommend to do this, to save us the trouble of coding a solution ourselves?

This is adding a great deal of complexity to the concept of a simple file transfer, so I want to make sure our design is solid before we begin down this path.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Sounds good to me. A centralized (S)FTP server for interorganizational file transfers is fairly common. Just set up the (S)FTP server as tightly as you can, and firewall it locally against any unintended connections.

As far as coding... there's not much to code. Just set your logging level fairly high, and create unique user accounts for each organization or user. Lock any external (and most internal) users down to their own directory.

If you want to take it one level further, you can also whitelist the allowed source IPs that can connect to your server. For example, make the external organizations register their source IP blocks, and only allow outside connections from those.

share|improve this answer
    
Thanks! This is reassuring and makes me feel more confident about our plan. I appreciate the other tips too. –  Derek Jul 17 '12 at 21:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.