How to secure FTP passwords

Question

What do others do to secure FTP passwords? My scenario doesn't seem too unique to contract web developers and web marketing/design companies, but having trouble finding any answers I like online.

The scenario:

I have access to lots of FTP sites, on different servers, and none servers that I own or control. Most of the people that provide me these credentials have very limited technical skills, and several don't know how to change a password or setup a separate account for me. Less than 1% use SFTP or SSL over FTP, so mostly "plain text" passwords going over the wire.

If these passwords fall in to the wrong hands, it becomes a real mess, partially because it can take days to change the password or disable the account/etc. So I can spend lots of time cleaning up the trashed/infected website, only to have it infected again, and again, until they finally figure out how to change the password.

Ideas I've had so far:

1. Just use KeePass to store passwords encrypted, and feel "safe enough". I don't like this idea, because any virus that watches network traffic can still see all of my FTP passwords. A virus could be on my system for weeks or months, and get lots of passwords.

2. Have a separate PC I use for FTP only, and store passwords on it with KeePass. Main problem here is I need to be able to work from anywhere, home/remote/etc., and I don't want to carry 2 laptops around with me. I'd need remote desktop access probably, but then a hacker could get the RDP password with a keylogger/etc., and remote to that PC themselves. They could also get the KeePass password, and the file (once they have the RDP password).

3. One PC with VMware. Never do anything in the "host" (non-VM) so that it should "never" get a virus, and have one VM that I work in, and another for FTP only (that also should never get a virus). Sounds like the best route so far, but the hardware required to run a VM like this, and still get decent speed, seems expensive. Just for me (not counting other employees) I'd need 3 of these boxes, because I like having a desktop PC at work, home, and my cabin.

4. One PC with all FTP info stored on it, AND NO ACCESS to it at all, except via FTP/SFTP or some proprietary protocol/program. This "server" would be like an FTP proxy or something, except it would also inject the login info before sending to the real FTP server. So the FTP client on my PC would just send the host/URL, and user name, but then just always send "password" or "blank" as the password, and the FTP "proxy" would look up the real password in a database and modify the stream before sending to the real server. I could only update the password database from the server (console), and I would never run any apps/etc. on the server.

5. An FTP client that allows remote control. So I could have it installed on some very secure box, and then remote control it from another. At least then, if another person gained access to remote control it, they still couldn't get the passwords from it, so they could only trash the websites, but not continue to do it over and over.

Conclusion (so far):

4 and 5 are the only ones that start to sound secure to me (as long as the proxy or remote controlled client didn't have vulnerabilities), but I don't think either of those exist. I guess 5 could be something like a website that hosts an FTP client for you, so you login and manage your FTP accounts (but never have a way to get a password back out, after you enter it), and do all of your FTP stuff through them. So as long as their server is secure, so is your account info and traffic. Maybe a "Web to FTP" provider? I would want the interface to be real easy though, like copy/paste support, like I can do with most FTP clients -- that could be a deal breaker I guess. A hacker could get my login info for this service, and use it to trash websites, but at least could not get the FTP credentials.

Before you say "just use Anti-Virus software"... we had the most recent versions of Avast and MS Security Essentials on two different PCs, and both still got infected with something that sent several FTP passwords off to the Ukraine. Very embarrassing for us, having to ask clients to change FTP passwords, and having to wait several days for some of them to figure out how to (sending emails to their hosting companies, because they have no phone support, and it was over a weekend).

p.s.-We are a Windows based office, so looking for Windows based solutions... or at least Windows based clients can access (if a Unix server).

Answer 1

This is not your problem. If a 3rd party chooses to only provide non-secure methods for you to use then it's not your fault if the server is compromised.

Best solution: train them as to why it's insecure and get them to hire a 3rd party to resolve the issue. If you have given them fair warning to the insecurity of the FTP protocol and they still choose to use FTP then that's their choice and you have to respect it.

Answer 2

As you state in your question, FTP isn't secure. Cleartext passwords are a disaster waiting to happen. The best you could do is make sure you only connect to FTP servers on networks you trust, e.g. not public wifi. If you need to connect to the FTP server and cannot trust the network, forward your FTP connection over something secure, like a VPN connection or an SSH tunnel, to a server you control. Ideally this machine is as close to the FTP server as you can get it. Search for "SSH port forwarding with PuTTY", using PuTTY to forward to a cheap Linux VPS is likely the easiest solution.