Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 1 down vote favorite

Is there anyway to change hostname from being [ftp://mysite.com]?. Im not sure if there is any benefit to doing this but I notice that for high profile sites that doesnt get me to their FTP login, so why does it have to go to mine?

share|improve this question
5  
If ftp://mysite.com works, then there is an FTP server running at mysite.com. If you own mysite.com and you don't want that, shut down the FTP server. – William Jackson Mar 21 '12 at 20:57
@WilliamJackson you should make this an answer not a comment. It's exactly what they need to do, to prevent ftp:// in the browser from accessing their ftp server. – Anagio Mar 21 '12 at 21:35

migrated from webapps.stackexchange.com Mar 21 '12 at 21:30

2 Answers

up vote 8 down vote

If ftp://mysite.com works, then there is an FTP server running at mysite.com. If you own mysite.com and you don't want that, shut down the FTP server.

share|improve this answer
up vote 5 down vote

What is the operating system on your server?

Do you have a dedicated server, or are you on a shared hosting?

If you have a dedicated server and it's OS is GNU/Linux or Unix like (BSD, MacOS), you must shut down your FTP server, and use SSH instead of it to put file on it:

FTP is a very bad protocol, because it's totally unencrypted. Actually, most FTP client (like FileZilla, who is free for Windows, GNU/Linux and MacOS X) support SSH for file transfer, so why keep a week and unencrypted service open?

You cans also use WinSCP for this.

It's just a other door to try for cracker, sniffing your network for login/password and files, or for brut force attacks.

if you are on a shared hosting, it seems that you don't have the choice: ask the support of your provider about it, but few of them let you use SSH instead of FTP, and even you can use SSH (like some hosting plan with 1and1), the FTP service will always work for you as for the others customers.

At this point, you must be aware of one thing : shared hosting who permit both SSH and FTP often use same login/password for the two protocols!

So, NEVER user FTP in this case, because you can reveal your SSH login at this occasion to anyone listening the traffic between you and your server.

If you are under Windows environment, then, try FTP with SSL, it's better than nothing.

You can also install a Cygwin environment with an SSH server. It's a bit complicated to do it properly, without creating new vulnerabilities, but when it's properly done, it's the better option in this case IMHO!

share|improve this answer
What you say is good, but SFTP is encrypted. – paulmorriss Mar 22 '12 at 14:21
2  
SFTP is not FTP, but SSH File Transfert Protocol, as I said, and do not need a FTP server ^^ – Pascal Qyy Mar 22 '12 at 16:38
FTPS can be better than SFTP in some circumstances, since it uses certificates (which you can verify using a PKI and that will have a host-name) as opposed to bare public keys (which you'd need to verify on the first connection explicitly, in theory). Whether this feature is useful/required depends on the use-case. – Bruno Mar 22 '12 at 19:33
2  
Sorry, but you can use PKI with SFTP as well. – Pascal Qyy Mar 23 '12 at 12:18
2  
You can indeed use PKI with SFTP, but what you're linking to is not PKI despite what the blog says: it's just using SSH key (missing the "Infrastructure" part). PKI is about verifying the identity bound to a key, usually via CAs (like it's done for website certs). You can use PKI (as in RFC 5820) with SSH, but you need to patch OpenSSH to to use X.509 certs (and to handle the verification process via a CA). There is also similar integration in GSI-SSH. These are not mainstream, and barely using an SSH key isn't it. – Bruno Apr 21 '12 at 20:12
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.