Centralizing our FTP processes via an SFTP server in our DMZ

Question

We have a number of various FTP processes, running on various internal servers, that connect with outside vendors to send or receive sensitive data files. As such, we don't have one centralized place to keep track of these processes and log what files are being transferred. At the same time, we're worried about staff sending unapproved files to outside organizations without us knowing about it. And for those vendors that push files to us, we'd prefer in the future that they not be allowed into our network, even if solely via FTP. To address these concerns, we're considering a solution with two primary goals:

1. Centralize all FTP transmissions so that they are all handled from one place that is easily monitored.
2. Block all ports in our firewall that allow FTP and SFTP communication.

This is what we are planning: we'll put an SFTP server in our DMZ to interact with our vendors, so that they never need to go through our firewall in the future. Then, we'd have a web service set up on both the DMZ and an internal server that will send the files to each other through our firewall over TCP/IP using SSL.

I'd like others' thoughts on this idea, namely:

1. Is this idea feasible and secure? Or is there a flaw in it that may be giving us a false sense of security?
2. Are there any software packages out there that you would recommend to do this, to save us the trouble of coding a solution ourselves?

This is adding a great deal of complexity to the concept of a simple file transfer, so I want to make sure our design is solid before we begin down this path.

Answer 1

Sounds good to me. A centralized (S)FTP server for interorganizational file transfers is fairly common. Just set up the (S)FTP server as tightly as you can, and firewall it locally against any unintended connections.

As far as coding... there's not much to code. Just set your logging level fairly high, and create unique user accounts for each organization or user. Lock any external (and most internal) users down to their own directory.

If you want to take it one level further, you can also whitelist the allowed source IPs that can connect to your server. For example, make the external organizations register their source IP blocks, and only allow outside connections from those.