topic Re: FTP server encrption. in Operating System - HP-UX

FTP server encrption.

Jeganraj — Sun, 25 Dec 2005 02:32:41 GMT

Dear all,

Can anyone help me to achieve the following scenarios related to FTP server encrption / decryption.

1) Outbound with respect to Oracle application
We have to exchange a file from Our ftp (ftp.company.com) site to 3rd party FTP site (ftp.anothercompany.com). The idea is we will place the file from our application system to our FTP site, from there we have to encrypt and send the encrypted file to 3rd party FTP server.

2) Inbound with respect to Oracle application
We have to exchange a file from 3rd part ftp site (ftp.anothercompany.com) to Our ftp site, here the 3rd part system will place the file from there system to their FTP site, from there we have to pickup the encrypted file and decrypt then placed it to our FTP Site.

Thanks in advise,
Regards,
J.Marlose

Re: FTP server encrption.

Delrish — Sun, 25 Dec 2005 03:03:07 GMT

Do you need encryption for Secure delivery over Internet?
If yes, Why do you want to use FTP?
You can use SCP, and you won't to encrypt/decrypt the file manualy.

Re: FTP server encrption.

Delrish — Sun, 25 Dec 2005 03:09:35 GMT

Also, You can use SFTP (Secure File Transfer Protocol)

Re: FTP server encrption.

Steven E. Protter — Sun, 25 Dec 2005 05:50:42 GMT

Shalom J,

No matter what you do, the authentication of the ftp will travel back and forth across the Internet in clear text, therefore compromising security.

However,
I recall in 2002, I took a class at HP's Mountain View Eduction center where we used kerebos to authenticate ftp. That might solve the problem.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=788344

Still, Secure shell, Openssh is a better way to go.

SEP

Re: FTP server encrption.

Jeganraj — Sun, 25 Dec 2005 11:59:37 GMT

Thanks for all ur reply.
My current ftp server is not SFTP and i cannot change that to SFTP due to some dependancies. But incase if i wants to do manual encrption / decryption process only for an ftp account. Is it possible? Anyway of doing it?

Thanks once again for all your help.

J.Marlose.

Re: FTP server encrption.

Gary L. Paveza, Jr. — Mon, 26 Dec 2005 07:51:17 GMT

You can buy software that will encypt the data (we use PGP). However, the ftp traffic itself is unencrypted (meaning the login / password / any commands are passed in plain text.

Re: FTP server encrption.

Steven E. Protter — Mon, 26 Dec 2005 09:35:40 GMT

There are no dependencies to install Secure Shell, openssh, which includes sftp,ssh and scp.

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

The second link in my earlier post tells how to kerebize your ftp authentication. This will however make it fail with certain(many) ftp clients that can't handle encrypted authentication.

SEP

Re: FTP server encrption.

Jeganraj — Tue, 27 Dec 2005 09:01:30 GMT

Hi Gary,

Thanks for your reply. How did you configure PGP to encrypt the files in FTP server and what pgp software are used for ur env. Is it installed in FTP server side or client side encrypted /decryption. Can you tell more on this.

Thanks.
J.Marlose.

Re: FTP server encrption.

Jeganraj — Tue, 27 Dec 2005 09:04:25 GMT

Hi Steve,

The second link for kerborose authentication is missing man.

J.Marlose.

Re: FTP server encrption.

Ralph Grothe — Tue, 27 Dec 2005 09:31:31 GMT

Hi,

just wanted to pick up the Kerberos thread dropped by SEP.
Afaik, a kerberized FTP application will not encrypt the FTP data stream travelling over the net.
Kerberos is "only" good for achieving single-sign-on by authenticating and authorizing users who access kerberized applications (such as FTP).
Actually in a Kerberos environment there will never be any passwords exchanged.
Inspite a Key Distribution Center (KDC) is sending a Ticket Granting Ticket (TGT) to a user when he first tries to authenticate to an application.
The TGT is encrypted with the user's password which is stored centrally in a list on the KDC.
For the KDC the user is authenticated as soon as he can decrypt the TGT.
After that the user requests tickets for each kerberized application he wishes to use throuh the TGT.
It is important to note that there are no passwords clear text or encrypted but only tickets exchanged.
These tickets usually expire after a set time.
Thus an attacker even if he could manage to get hold of a valid ticket could in theory only compromise a single session for a limited time.
The greatest threat is that the KDC ever gets compromised.

To read more about the MIT's implementation of the protocol see
http://web.mit.edu/kerberos/www/

There must be also ample documentation on how to kerberize HP-UX applications from here:
http://docs.hp.com/en/internet.html#Kerberos

But I think a much easier and less involved approach would be to use SSH's sftp
as already suggested by others.

Re: FTP server encrption.

Ivan Ferreira — Tue, 27 Dec 2005 10:14:51 GMT

To encrypt the channel, you can use ssh tunnel with ftp.

http://www.tacc.utexas.edu/resources/userguides/ftp/

To encrypt/decrypt files transferred, you can use gnupg.

Re: FTP server encrption.

Ivan Ferreira — Tue, 27 Dec 2005 10:19:36 GMT

See this guide about how to use gnupg:

http://www.gnupg.org/gph/en/manual.html

Re: FTP server encrption.

Gary L. Paveza, Jr. — Tue, 27 Dec 2005 11:24:40 GMT

It's fairly simple. We use PGP software. Basically, you have your files that you want to encrypt. On the server side, you encrypt the files using the PGP software using the public key of the receipient. Then you can ftp the files. Username and password for the ftp session are still sent in plain text (this can be removed by using secure shell instead of ftp), but your data is protected. On the receiptients side, they would need to run pgp decrypt against the files.

One of the benefits is that the data remains encrypted on the receiptients side until they decrypt it.

Re: FTP server encrption.

Jeganraj — Wed, 28 Dec 2005 08:50:33 GMT

Hello All,

Thanks for your replies and the time spend to support me.

Cary,
Now i got idea for implementation and the product to be used.
Is it mendatory to have identical PGP software at both end or Can we have one side as commercial pgp and other side gnupgp.

Now our plan is to implement PGP for data encrption/ decryption with secured FTP(SSH).
Hope it gives the complete end to end security solution while transit and for stored information.

Thanks to all once again.

Regards,
J.Marlose