up vote 1 down vote favorite
share [g+] share [fb]

I've seen several comments on internet in which people say something like:

"I've uninstalled SFTP server, it is much better, it remove security vulnerabilities"

What are these vulnerabilities, if there are any?

link|improve this question
100% accept rate
feedback

2 Answers

up vote 3 down vote accepted

SFTP runs over SSH, although some servers use a separate executable for them. Whatever vulnerabilities that executable may have is what you're being protected from (although I've not heard of any myself). The protocol itself is as secure as your SSH server.

link|improve this answer
I think it is important to not give someone access to SFTP that you would not want to have an account on the SFTP server. – Slartibartfast Nov 9 '10 at 23:59
@Slartibartfast: Considering that you need to have a system account in order to have SSH access in order to have SFTP access... – Ignacio Vazquez-Abrams Nov 10 '10 at 0:08
I think the importance of my comment is substantiated by the 480,000 search results for 'sftp only account' in google. – Slartibartfast Nov 11 '10 at 4:40
feedback
up vote 4 down vote

SFTP has two meanings.

The old meaning of SFTP is old Secure FTP, which only secured the control channel and left the data channel unencrypted.

New SFTP is SSH FTP which secures all traffic with SSH.

New SFTP good, old SFTP bad.

Another alternative is SCP, which is usually faster than sftp.

link|improve this answer
1  
I've never heard the first called SFTP. Or come across any implementations of it, ever. – Ignacio Vazquez-Abrams Nov 9 '10 at 15:54
Yes, it is ancient. Just as ancient as many comments on deleting it. – Posipiet Nov 9 '10 at 15:57
First I've heard of it and I though I knew a lot of obscure old school options. Was it, perhaps, not very common even back in the day? OTOH, such comments about the ssh tool would seem to be nonsensical, so this seems like a reasonable explanation and "sftp" is a fairly obvious thing to call your "more secure" file transfer tool... – dmckee Nov 9 '10 at 16:24
I've actually seen a third "sftp", which stood for "slow FTP". It was designed to not saturate network connections. It never took off and I never actually ran into a server that supported it, but it was being actively talked about for a while. – CarlF Nov 9 '10 at 17:28
1  
@Zayne: FTPS is FTP-over-SSL, which is sane if rare (and something somewhat different). – Ignacio Vazquez-Abrams Nov 9 '10 at 18:52
show 2 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.