Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've seen several comments on internet in which people say something like:

"I've uninstalled SFTP server, it is much better, it remove security vulnerabilities"

What are these vulnerabilities, if there are any?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

SFTP runs over SSH, although some servers use a separate executable for them. Whatever vulnerabilities that executable may have is what you're being protected from (although I've not heard of any myself). The protocol itself is as secure as your SSH server.

share|improve this answer
    
I think it is important to not give someone access to SFTP that you would not want to have an account on the SFTP server. –  Slartibartfast Nov 9 '10 at 23:59
1  
@Slartibartfast: Considering that you need to have a system account in order to have SSH access in order to have SFTP access... –  Ignacio Vazquez-Abrams Nov 10 '10 at 0:08
1  
I think the importance of my comment is substantiated by the 480,000 search results for 'sftp only account' in google. –  Slartibartfast Nov 11 '10 at 4:40

SFTP has two meanings.

The old meaning of SFTP is old Secure FTP, which only secured the control channel and left the data channel unencrypted.

New SFTP is SSH FTP which secures all traffic with SSH.

New SFTP good, old SFTP bad.

Another alternative is SCP, which is usually faster than sftp.

share|improve this answer
1  
I've never heard the first called SFTP. Or come across any implementations of it, ever. –  Ignacio Vazquez-Abrams Nov 9 '10 at 15:54
    
Yes, it is ancient. Just as ancient as many comments on deleting it. –  Posipiet Nov 9 '10 at 15:57
    
First I've heard of it and I though I knew a lot of obscure old school options. Was it, perhaps, not very common even back in the day? OTOH, such comments about the ssh tool would seem to be nonsensical, so this seems like a reasonable explanation and "sftp" is a fairly obvious thing to call your "more secure" file transfer tool... –  dmckee Nov 9 '10 at 16:24
    
I've actually seen a third "sftp", which stood for "slow FTP". It was designed to not saturate network connections. It never took off and I never actually ran into a server that supported it, but it was being actively talked about for a while. –  CarlF Nov 9 '10 at 17:28
2  
@Zayne: FTPS is FTP-over-SSL, which is sane if rare (and something somewhat different). –  Ignacio Vazquez-Abrams Nov 9 '10 at 18:52

One other item that is related. I notice that when you open up SFTP my network starts to get a huge number of attacks (mostly from China). My guess is that they are just trying to hit SSH which also needs to be open. However, if I set up FTP with TSL/SSL I don't get any such attacks. That might imply that FTP with TSL/SSL is more secure. I mean, not that it is actually more secure, but in a practical way because it is getting less attacks.

Now, what I did do is to change my SSH port to some other number and that definitely reduced the number of attacks getting through my router to my server, but I still get more attacks using SFTP than I do using FTP with TSL/SSL. Just an observation that might interest someone viewing this thread.

Still, if you are setting up a server or a network share or something, I would recommend using a different port for SSH than the default.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.