How unsafe is FTP?

dreniarb · 2018-01-23T19:08:10.000Z

Jaapyse:

So, how do I safely get files to a server with Hyper-V core installed on it?

There’s no browser to download a real FTP client, and I don’t wanna run an FTP server solely for the distribution of browsers to Hyper-V core servers.
You can’t use repositories like in Linux.

What options do I have left?

If you’re on the same local network as the server you can use \servername\c$ to get to the files.

If you need FTP you could try the free version of Zftp server. I’ve been using it for years as an SFTP server. I’ve not used this newest version though so i can’t speak to it’s friendliness.

http://zftpserver.com/solutions/free-file-sharing/

CoreFTP also has a free mini SFTP server that I’ve used and it works quite well.

coreftp.com

SFTP Server - Secure FTP server software for Windows with SFTP, FTPS, and...

SFTP Server / FTP Server with SSL, TLS, SSH/SFTP, and HTTPS support.

Their client is nice too. It’s what I use to connect to my SFTP servers.

coreftp.com

Free FTP client, secure file transfer software

Fast, reliable, FTP client software with SFTP (SSH), SSL, and TLS support. Download a free, secure ftp program today

For command line use try psftp.

https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

seydon · 2018-01-23T19:37:10.000Z

Jaapyse:

Seydon:

The native windows FTP client (command prompt) doesn’t support encryption at all…

If you use SFTP (FTP over SSH), you’ll need a real FTP client (major ones, even free ones support that). Same goes for FTPS (FTP with TLS)…

So, how do I safely get files to a server with Hyper-V core installed on it?
There’s no browser to download a real FTP client, and I don’t wanna run an FTP server solely for the distribution of browsers to Hyper-V core servers.
You can’t use repositories like in Linux.

What options do I have left?

Euh… the client should run from your computer, not the hyper-v server… Now, I do not know hyper-v enough, but there should be a way to enable ftps (this is supported by IIS, so must be by hyper-v core as well)…

CrashFF · 2018-01-23T20:25:55.000Z

SFTP is much easier to secure through a firewall because it uses one port for everything. FTPS uses one port for commands and login, and then opens up an additional random port for file transfers. because of this, SFTP speeds tend to be slower than FTPS because of the embedded control, encryption and handshaking overhead that are all done over the single port used. Both FTPS and SFTP have a much lower overhead than HTTPS, making both options a faster alternative. I try -not- to recommend anything HTTPS for file transfers if you can help it when it comes to large file transfers, either in number, or in byte-size.

I find the only benefit of an HTTPS upload/download is the user interface is web based accessibility to the end user, which in many cases wins out because BFU…

spike3 · 2018-01-23T21:05:32.000Z

TagYourIT:

WTF FTP USE SFTP

hmm… yeah… so… I recognize the bad “FTP” protocol, the good “SFTP” protocol, not sure about the “USE” protocol…

… and what is the “WTF” protocol for??

@tagyourit

erichenriksen · 2018-01-23T21:47:35.000Z

Years ago, one of my friends ran an FTP server on his home machine/server. He logged into it one day to find that there were new folders that he couldn’t get into and couldn’t delete. Someone had gained access and set up an account, created files and locked him out of it. He ended up shutting the machine down and rebuilding it with a more secure solution.

egpetey · 2018-01-23T22:27:13.000Z

Jaapyse:

So, how do I safely get files to a server with Hyper-V core installed on it?
There’s no browser to download a real FTP client, and I don’t wanna run an FTP server solely for the distribution of browsers to Hyper-V core servers.
You can’t use repositories like in Linux.

What options do I have left?

See #2: Asking Better Questions

What are you trying to do here?

I just use the administrative share to transfer files to/from my Hyper-V Servers (the less-than-core free hypervisor only).

jamesholden8454 · 2018-01-23T23:41:38.000Z

linksep:

Jaapyse:

So, how do I safely get files to a server with Hyper-V core installed on it?
There’s no browser to download a real FTP client, and I don’t wanna run an FTP server solely for the distribution of browsers to Hyper-V core servers.
You can’t use repositories like in Linux.

What options do I have left?

See #2: Asking Better Questions

What are you trying to do here?

I just use the administrative share to transfer files to/from my Hyper-V Servers (the less-than-core free hypervisor only).

I’ll second this. It might be more helpful if you tell us exactly are you trying to do and why? I’m not a HyperV user myself, but if it’s setup like other virtualization platforms, it is intended to be managed entirely with remote tools. The console really only exists for recovery purposes. Within a M$ environment the native SMB shares are almost always one of the best options for file transfers.

harrybaynes · 2018-01-24T00:01:46.000Z

If security is the overall concern I would consider Titan SFTP. Its better than your run of the mill Sftp software as it has all the usual suspects including HTTPs. BUT, where it really excells is all the anti Hack security under the bonnet. I have used it for over 14 months and it has been an easy setup and worry free motoring. In the time it’s been up it has blocked and banned over 9295 IPs &bots. The ‘Event’ handlers are especially good and useful for tailoring your security needs. Support is very good also. Works well with all clients but we prefer FileZilla over others.

martinbooth1040 · 2018-01-24T07:44:32.000Z

Its not best practise to have any ports open to the Internet, it would be better to connect via VPN (using pre-shared keys or certificates) and then work as if you are on your local network.

shaunhepworth · 2018-01-24T07:56:02.000Z

You should always go for some kind of security, SFTP is a better alternative. Protect your credentials, protect your identity.

harmennieuwenhuyzen · 2018-01-24T08:28:55.000Z

Okay, to clarify, this is why I want to transfer files to Hyper-V:

I often want to install an agent of our RMM software on the Hyper-V host. In order to download the installer I used FTP, but now that that’s out of the picture I need a different way. The only way I can currently think of is a share, like Jason1121 mentioned.

The main reason why I’m looking for a way that works on Hyper-V core is that, if I find a way, it will work on most Windows devices without problems. I was kinda hoping Windows would have some kind of builtin alternative to wget or something. FTP was always really useful on these core servers. I know you can install a browser on them, but then again you’d need to get installer on it.

Jaapyse

allenharkleroad · 2018-01-24T09:36:24.000Z

Sometimes FTP is the best and most cost effective method and if properly secured is not that much of a security issue. Of course if you don’t know who to properly secure servers such as web servers, FTP, SQL, etc for use on the Internet then it is best to find a knowledgeable company or person to implement it.

We have a client that uses FTP for large video file transfers (TV ads, some are 1GB or larger in size), it is the simplest least complicated way for folks to send their ads to the client. We built out the server and locked it down to only serving connection on ports 21 & 22. It is segregated outside of the corporate network and even on different public IP address space, while still being on premises.

mtodd-it · 2018-01-24T13:25:29.000Z

Another concern is that hackers will get your logon info, then upload a huge amount of data. Keep an eye on the uploads.

joemccann · 2018-01-24T13:26:29.000Z

Just adding my experience here, as I worked with a financial services comapny for many years whom dealt with this issues. As we had banks and financial services companies sending up files/data to our “DMZ” as a delivery point, over FTP. We quickly moved away from FTP(Port 21) and to SFTP (Port 22). Using clients such as WRQ Reflections and FileZilla through to the file directory in our DMZ. Once these files were dropped into the DMZ (folders), they would be viceversa’d across the network to an FTP server, where they would then be distributed to the relevant File Servers (book of business). The company was 78,000 people large, so the acceptance criteria here for making this solution “Safe” could have been more politics, for the technical assurance board…but that is how we done it.

i guess main things to note are

1)SFTP

2)DMZ

3)Network routing across many VLANs and Subnets etc

matt161 · 2018-01-24T13:39:22.000Z

If the data you are sending is something you want to keep confidential then use encryption. But if you are just sending data you don’t really care about then FTP away.

I have a feeling that you care about this data… since you are asking and all.

seydon · 2018-01-24T14:39:16.000Z

Matt4463:

If the data you are sending is something you want to keep confidential then use encryption. But if you are just sending data you don’t really care about then FTP away.

I have a feeling that you care about this data… since you are asking and all.

It is not just about the data… It is about the credentials as well… With plain FTP, credentials are sent in clear… If data is not confidential and connection is anonymous, then, might be fine yes, but as soon as you authenticate with your credentials, you can assume those are compromised…

dzee · 2018-01-24T15:30:17.000Z

Are you using one of the many encryption protocols available with FTP?

Your questions is “How much of a security risk is this?” Risk is a spectrum that depends on what you’re putting at risk.

If you’re transferring an plain-text file containing the logins and passwords for everyone’s accounts at a financial institution, of course that’s insanely risky and “security” is wishing nobody happens to be looking at the data as it passes by. On the other hand, if you’re transferring a list of your favorite movies in an Excel spreadsheet, then risk is low.

There are encrypted FTP protocols that use a few additional ports, there are ways of doing FTP within a far more secure encrypted channel such as VPN up to and including RSA tokens.

Bottom line: There is no one-size fits all answer for whether FTP is safe or risky. It is still used widely today for the transfer of data files, but unless it’s something really mundane, most transfers are encrypted using one of the built in protocols if not a more elaborate wrapping one.

MarkT94 · 2018-01-25T14:20:43.000Z

Cambridgeport90:

if you want something good, consider CompleteFTP. Is for Windows, Runs on pure .NET, and supports multiple protocols for file transfer; you could use FTPS, SFTP, HTTPS, or HTTP if you so felt like it.

Thanks for posting this. I’ve been using FileZilla for internal FTP purposes, but shut the server down when I am not using it. Primarily just for Cisco firmware updates via CLI.

russbrustky · 2018-01-26T18:28:38.000Z

If possible use sftp through a vpn if going over the internet. If it is all local make a subnet for ftp traffic that was wireless and other users cannot capture the data.

jamesholden8454 · 2018-01-29T19:23:18.000Z

Jaapyse:

Okay, to clarify, this is why I want to transfer files to Hyper-V:

I often want to install an agent of our RMM software on the Hyper-V host. In order to download the installer I used FTP, but now that that’s out of the picture I need a different way. The only way I can currently think of is a share, like Jason1121 mentioned.

The main reason why I’m looking for a way that works on Hyper-V core is that, if I find a way, it will work on most Windows devices without problems. I was kinda hoping Windows would have some kind of builtin alternative to wget or something. FTP was always really useful on these core servers. I know you can install a browser on them, but then again you’d need to get installer on it.

Jaapyse

If you are only using it to download the installer, and you are downloading it either from a public source such as the vendor’s website using anonymous login or your own internally hosted ftp server, then I really don’t see any problem with using plain old ftp. As others have mentioned, the biggest problem with using ftp is that there is no security, but if you don’t care who knows what you are downloading and you aren’t using login credentials that should be secret, it’s really no different than downloading software from an HTTP server instead of an HTTPS server. We’ve all been doing that for as long as we can remember. Technically speaking, HTTP or FTP does carry a higher risk of someone being able to MITM and replace the file you are downloading, but it’s probably just as likely for an HTTPS website to be compromised. If you want to be diligent, you can verify your downloads by hashing them just like us Linux heads do.

Honestly though, the way I usually handle downloads for software destined for any Windows server is by downloading it and verifying it using a workstation, then transferring it to a SMB share either located on that server or accessible by that server. That way I minimize the chances of exposing the server to anything nasty. I can only assume that the terminal of Hyper-V core can access a SMB share by using “\server\share\filename.exe” or mount the share with “net use x: \server\share” and this is the method I’d recommend using instead of downloading the file directly.