Is there anyway to disable ftp://example.com?. I'm not sure if there is any benefit to doing this but I notice that for high profile sites, using that doesn't get me to their FTP login, so why does it have to do so for my site?
Add a comment
|
2 Answers
If ftp://example.com works, then there is an FTP server running at example.com. If you own example.com and you don't want that, shut down the FTP server.
What is the operating system on your server?
Do you have a dedicated server, or are you on a shared hosting?
If you have a dedicated server and it's OS is GNU/Linux or Unix like (BSD, MacOS), you must shut down your FTP server, and use SSH instead of it to put file on it:
FTP is a very bad protocol, because it's totally unencrypted. Actually, most FTP client (like FileZilla, who is free for Windows, GNU/Linux and macOS X) support SSH for file transfer, so why keep a week and unencrypted service open?
You cans also use WinSCP for this.
It's just a other door to try for cracker, sniffing your network for login/password and files, or for brut force attacks.
if you are on a shared hosting, it seems that you don't have the choice: ask the support of your provider about it, but few of them let you use SSH instead of FTP, and even you can use SSH (like some hosting plan with 1and1), the FTP service will always work for you as for the others customers.
At this point, you must be aware of one thing: shared hosting who permit both SSH and FTP often use same login/password for the two protocols!
So, NEVER user FTP in this case, because you can reveal your SSH login at this occasion to anyone listening the traffic between you and your server.
If you are under Windows environment, then, try FTP with SSL, it's better than nothing.
You can also install a Cygwin environment with an SSH server. It's a bit complicated to do it properly, without creating new vulnerabilities, but when it's properly done, it's the better option in this case IMHO!
-
-
2SFTP is not FTP, but SSH File Transfert Protocol, as I said, and do not need a FTP server ^^ Commented Mar 22, 2012 at 16:38
-
FTPS can be better than SFTP in some circumstances, since it uses certificates (which you can verify using a PKI and that will have a host-name) as opposed to bare public keys (which you'd need to verify on the first connection explicitly, in theory). Whether this feature is useful/required depends on the use-case.– BrunoCommented Mar 22, 2012 at 19:33
-
2
-
2You can indeed use PKI with SFTP, but what you're linking to is not PKI despite what the blog says: it's just using SSH key (missing the "Infrastructure" part). PKI is about verifying the identity bound to a key, usually via CAs (like it's done for website certs). You can use PKI (as in RFC 5820) with SSH, but you need to patch OpenSSH to to use X.509 certs (and to handle the verification process via a CA). There is also similar integration in GSI-SSH. These are not mainstream, and barely using an SSH key isn't it.– BrunoCommented Apr 21, 2012 at 20:12