FTP server / web server security question

Ok,

I have a friend who has an idea on how to keep his server more secure. I think he is creating way more work for himself and not solving many promblems. I want to run this by the people here to see what you think:

Instead of FTP'ing files to the directory you want them, you have to upload them to your home directory, then ssh in to the machine, switch to super user mode, and copy them into the web server directory.

I don't see how this is solving any problems, since you still can't get the files into the web server tree unless you log in under super user mode.

Any ideas on how I can convince him this is a bad idea? I use the server as well, and I don't really want to go through all this just to upload one stinkin' file once and a while.

Thanks in advance.

But think about it, even though it will take longer just to upload the file.
Just think about how long it will take someone if they try to compromise the server..
I'd happily go along with your mate's idea it sounds good.


cheers
.:front2back:.

I don't know about the security that much, but I'm sure you have to login to use the ftp. So you could just change the DocumentRoot in the httpd.conf to something in the home directory like /home/user/www
and make sure that folder is created before you restart the webserver, and you do have to restart the webserver for all changes in the config. Of course I was assuming apache here, but I'm sure you can do similar things to other webservers. I guess your main issue is keeping up with patches on your webserver, sshd, and ftp server. Keep up with vulnerabilities and patches on those, and you should be good.

edit
s/you/your friend

Yes we are using Apache, and yes we are uploading to our home directories using FTP.

My main issue is that I've never seen a server do this. Even paid hosts that are supposed to be fairly secure allow you to upload to your web directory. He's trying to tell me that everyone does this, but I haven't seen anyone do it.

I can no longer use the built-in FTP in programs like dreamweaver, becaues I'd have to login to the machine anyway to move the file, so I might as well do it all at once.

Plus, we would be using twice as much disc space on the server, because there'd be a copy in my home directory and a copy on the web directory.

I guess what I really want to know is how do the big guys (the expensive web hosts) do it and stay secure?

Considering that the super user account is a serious weakness in Linux/UN*X systems...

What part of utilizing that account even more frequently seems like a good idea? ;)

catch

Quote:

---

Originally posted here by Psychomantum
Instead of FTP'ing files to the directory you want them, you have to upload them to your home directory, then ssh in to the machine, switch to super user mode, and copy them into the web server directory.

---

If you use the same account and password for both the FTP and SSH then it's no use what so ever. FTP is a cleartext protocol so your username/password already got send over the network. And why on earth do you need root to update a couple of webpages?

I would give your account read/write permissions on the webserver directory and only allow ssh. Then you can use scp or sftp to directly copy the file to their location.

yup I'm with SirDice on this one..

the problem with FTP is the fact that passwords are sent in "plain text"
that's proppably why your friend doesn't want FTP to a "web folder"

using sftp (there must be windows sftp clients, I think..) would solve that, and you could still in one go place your content . .

sftp is just normal ftp over an ssl layer..

Quote:

---

there must be windows sftp clients, I think..)

---

Yep, WinSCP3 is the one I use. :)

It has support for SCP and SFTP sessions along with a failover should one method fail. Nifty little app. Yes, it's free.

The solution is bad, for several reasons. It is far better to simply setup your FTP server to dump the files directly into the appropriate directory using a virtual username (that exists within the FTP server only), OR to use SCP/SFTP to handle the transfer. Between the two, SCP is obviously the more secure option of the two.

PuTTY/pscp + iXplorer is a good combo for people who want an SCP-capable gui, as well as commandline tools. :)

Do I need a special deamon to run secure FTP?

If so, where can I get one?

It runs over port 22, SSH. On *nix, simply run the SSH daemon. On Windows, there are 3rd party SSH daemons available out there. Google it.

Just tunnel your normal FTP traffic over SSH. I would also do as Chsh suggested and use a limited user account setup solely for Web site maintenance on the FTP server.

This link should provide you with all you will need to use Dreamweaver securely.
http://www.macromedia.com/support/dr...uments/ssh.htm

-Maestr0

I am not familiar with SFTP, however, I can recommend a prog that is easy to use, easy to configure and encrypts all traffic. Try out EFTP. I use it at home and my ftp server is up 24/7. I have logged several attempts to crack it, but noone has yet. It starts off by sending the userid and pass encrypted with the blowfish algorithm. once the user has authenticated, then it sets up a pgp encrypted tunnel (i use 2056 bit). It takes it about 30 sec to a min to set the tunnel up, but with all the security features, it makes it secure. If anyone else has tried it, I would like to hear your opinions of it. I havent found any weakness, except that in order to get the encryption, you have to use the eftp client with the server. (both are free)

Thanks for all your help people.

I tried WinSCP and I like it a lot. I might suggest to him that he set it up for SFTP, but I can live with SSH's scp.

In the end, you can do all or none of the following:

1: lose telnet and ftp. Shut off services in /etc/xinetd.d/(name here, set disable to yes then kill -SIGHUP xinetd which causes it to reread config files and terminate the services that aren't available anymore).

The above removes two cleartext services and thus, the ability to be exploited.

2: get the latest rpm of ssh and run sshd. This provides ssh, scp, sftp services through port 22.

3: use a chrooted ftp service available through your browser (ftp://whatever...). This allows drag-and-drop ability and you can secure these directories for owners and groups, thus allowing greater security.

4: get webmin and create a few scripts that do all your moving for you. This can be run in ssl-mode if you want (even though nobody knows your certificate) and now you have point-and-click methods of updating your web pages.

FTP using browser to drag-drop your files.
Login with same browser through your webmin (http://yoursite:10000 usually) and with ACL-driven accounts, now you can do your work.

Just an idea.

This isn't an opinion or advice or anything of that nature, but from my professional experience... I've only seen plain text protocols exploted a handful of times, and each of those were either by insiders or alreadt exploited systems AND those compromises only lead to compromise of the accounts in question.

On the other hand I have seen many, many systems compromised via SSH, these attacks tend to be from outsiders and tend to break the service itself leveraging superuser privileges.

This is just antecdotal of course, but it does only further stress the point of multilevel security and or domain based access controls on public servers.

catch

Agreed, catch...I'm all for ACLs myself and have spent quite a bit of time trying to get it just right.