I've seen several comments on internet in which people say something like:
"I've uninstalled SFTP server, it is much better, it remove security vulnerabilities"
What are these vulnerabilities, if there are any?
Tell me more
×
Super User is a question and answer site for
computer enthusiasts and power users. It's 100% free, no registration required.
|
|
||||
|
|
|
SFTP runs over SSH, although some servers use a separate executable for them. Whatever vulnerabilities that executable may have is what you're being protected from (although I've not heard of any myself). The protocol itself is as secure as your SSH server. |
|||||||||||
|
|
SFTP has two meanings. The old meaning of SFTP is old Secure FTP, which only secured the control channel and left the data channel unencrypted. New SFTP is SSH FTP which secures all traffic with SSH. New SFTP good, old SFTP bad. Another alternative is SCP, which is usually faster than sftp. |
|||||||||||||||
|
|
One other item that is related. I notice that when you open up SFTP my network starts to get a huge number of attacks (mostly from China). My guess is that they are just trying to hit SSH which also needs to be open. However, if I set up FTP with TSL/SSL I don't get any such attacks. That might imply that FTP with TSL/SSL is more secure. I mean, not that it is actually more secure, but in a practical way because it is getting less attacks. Now, what I did do is to change my SSH port to some other number and that definitely reduced the number of attacks getting through my router to my server, but I still get more attacks using SFTP than I do using FTP with TSL/SSL. Just an observation that might interest someone viewing this thread. Still, if you are setting up a server or a network share or something, I would recommend using a different port for SSH than the default. |
||||
|
|
