Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If a client PHP application is periodically accessing a remote server via FTP, is there any security risks for the client?

I understand FTP is not inherently a secure protocol, but is this only the data over the connection is not secure?

share|improve this question

closed as off topic by Zoredache, mdpc, Scott Pack, Michael Hampton, John Gardeniers Dec 11 '12 at 11:18

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
If the client re-uses the password elsewhere, then using ftp means you have just handed out your password for something else that might need to be more secure. –  Zoredache Dec 7 '12 at 23:09
add comment

2 Answers

There are some possible attacks.

The first that comes to my mind would be a man-in-the-middle attack. This makes it possible to read and minpulate the data. It depends on what you do with the data. If you process it there might be a possibility for a security breach when the data is manipulated.

The easiest way to make it secure would be to add SSL/TLS ecryption to the connection.

share|improve this answer
add comment

Typically when using ftp software control connection is not encrypted so that username and password are passed as plaintext and could be intercepted. Same goes for data connection (directory listing and file transfers). If you need a secure solution make sure that your ftp server and ftp clients support SSL/TLS (FTPS).

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.