FTP server encrption.

[Jeganraj]

Dear all,

Can anyone help me to achieve the following scenarios related to FTP server encrption / decryption.

1) Outbound with respect to Oracle application
We have to exchange a file from Our ftp (ftp.company.com) site to 3rd party FTP site (ftp.anothercompany.com). The idea is we will place the file from our application system to our FTP site, from there we have to encrypt and send the encrypted file to 3rd party FTP server.

2) Inbound with respect to Oracle application
We have to exchange a file from 3rd part ftp site (ftp.anothercompany.com) to Our ftp site, here the 3rd part system will place the file from there system to their FTP site, from there we have to pickup the encrypted file and decrypt then placed it to our FTP Site.

Thanks in advise,
Regards,
J.Marlose

[Delrish]

Do you need encryption for Secure delivery over Internet?
If yes, Why do you want to use FTP?
You can use SCP, and you won't to encrypt/decrypt the file manualy.

[Delrish]

Also, You can use SFTP (Secure File Transfer Protocol)

[Steven E. Protter]

Shalom J,

No matter what you do, the authentication of the ftp will travel back and forth across the Internet in clear text, therefore compromising security.

However,
I recall in 2002, I took a class at HP's Mountain View Eduction center where we used kerebos to authenticate ftp. That might solve the problem.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=788344

Still, Secure shell, Openssh is a better way to go.

SEP

[Jeganraj]

Thanks for all ur reply.
My current ftp server is not SFTP and i cannot change that to SFTP due to some dependancies. But incase if i wants to do manual encrption / decryption process only for an ftp account. Is it possible? Anyway of doing it?

Thanks once again for all your help.

J.Marlose.

[Gary L. Paveza, Jr.]

You can buy software that will encypt the data (we use PGP). However, the ftp traffic itself is unencrypted (meaning the login / password / any commands are passed in plain text.

[Steven E. Protter]

There are no dependencies to install Secure Shell, openssh, which includes sftp,ssh and scp.

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

The second link in my earlier post tells how to kerebize your ftp authentication. This will however make it fail with certain(many) ftp clients that can't handle encrypted authentication.

SEP

[Jeganraj]

Hi Gary,

Thanks for your reply. How did you configure PGP to encrypt the files in FTP server and what pgp software are used for ur env. Is it installed in FTP server side or client side encrypted /decryption. Can you tell more on this.

Thanks.
J.Marlose.

[Jeganraj]

Hi Steve,

The second link for kerborose authentication is missing man.

J.Marlose.

[Ralph Grothe]

Hi,

just wanted to pick up the Kerberos thread dropped by SEP.
Afaik, a kerberized FTP application will not encrypt the FTP data stream travelling over the net.
Kerberos is "only" good for achieving single-sign-on by authenticating and authorizing users who access kerberized applications (such as FTP).
Actually in a Kerberos environment there will never be any passwords exchanged.
Inspite a Key Distribution Center (KDC) is sending a Ticket Granting Ticket (TGT) to a user when he first tries to authenticate to an application.
The TGT is encrypted with the user's password which is stored centrally in a list on the KDC.
For the KDC the user is authenticated as soon as he can decrypt the TGT.
After that the user requests tickets for each kerberized application he wishes to use throuh the TGT.
It is important to note that there are no passwords clear text or encrypted but only tickets exchanged.
These tickets usually expire after a set time.
Thus an attacker even if he could manage to get hold of a valid ticket could in theory only compromise a single session for a limited time.
The greatest threat is that the KDC ever gets compromised.

To read more about the MIT's implementation of the protocol see
http://web.mit.edu/kerberos/www/

There must be also ample documentation on how to kerberize HP-UX applications from here:
http://docs.hp.com/en/internet.html#Kerberos

But I think a much easier and less involved approach would be to use SSH's sftp
as already suggested by others.

[Ivan Ferreira]

To encrypt the channel, you can use ssh tunnel with ftp.

http://www.tacc.utexas.edu/resources/userguides/ftp/

To encrypt/decrypt files transferred, you can use gnupg.

[Ivan Ferreira]

See this guide about how to use gnupg:

http://www.gnupg.org/gph/en/manual.html

[Gary L. Paveza, Jr.]

It's fairly simple. We use PGP software. Basically, you have your files that you want to encrypt. On the server side, you encrypt the files using the PGP software using the public key of the receipient. Then you can ftp the files. Username and password for the ftp session are still sent in plain text (this can be removed by using secure shell instead of ftp), but your data is protected. On the receiptients side, they would need to run pgp decrypt against the files.

One of the benefits is that the data remains encrypted on the receiptients side until they decrypt it.

[Jeganraj]

Hello All,

Thanks for your replies and the time spend to support me.

Cary,
Now i got idea for implementation and the product to be used.
Is it mendatory to have identical PGP software at both end or Can we have one side as commercial pgp and other side gnupgp.

Now our plan is to implement PGP for data encrption/ decryption with secured FTP(SSH).
Hope it gives the complete end to end security solution while transit and for stored information.

Thanks to all once again.

Regards,
J.Marlose