FTP server in the Cloud: Difference between revisions

From Alliance Doc
Jump to navigation Jump to search
No edit summary
No edit summary
 
(15 intermediate revisions by 5 users not shown)
Line 1: Line 1:
{{Draft}}
<languages/>
<languages/>
<translate>
<translate>
''Parent page: [[CC-Cloud]]''
<!--T:1-->
<i>Parent page: [[Cloud]]</i>


There are two main ways that an FTP server can be configured, anonymous access, or authenticated access. In both case there are better alternatives. If you require anonymous FTP you really should only allow read access to the files, otherwise anyone could upload malicious files to your server which is a very big security vulnerability. A better alternative to anonymous FTP with read access is HTTP which can allow the public to download files from your server (see for example [[Creating a Webserver on CC-Cloud]]). If on the other hand you wish to have authenticated FTP, a much better option is to use SFTP (see [[Transferring files#From your personal computer]]), which uses the SSH protocol and can easily work with [[Ssh keys|ssh key]] authentication and is already configured to work on Linux VMs. There is also an encrypted version of FTP, FTPS (different from SFTP) which uses [[Configuring Apache to use SSL | SSL certificates]] for encryption rather than ssh keys.  Another issue with using authenticated FTP on Compute Canada cloud is that in most cases the FTP daemon maps authentication credentials to system accounts. This requires the associated system account to have a password which is against the cloud Acceptable Usage Policy which states that users may only access VMs with key-pair authentication. If there is still a good reason to use FTP over one of the alternatives given above see the linked to guides below on how to setup FTP on a VM.
=Better alternatives to FTP= <!--T:2-->
If you have the freedom to choose an alternative to FTP, consider the following options:


=Better alternatives to FTP=
<!--T:3-->
If you have the freedom to choose an alternative to FTP consider the follow options if you need:
* If you are considering anonymous FTP...
** ...for read-only access : Use HTTP (see [[Creating a web server on a cloud]]).
** ...for read/write access: The security risks of accepting anonymous incoming file transfers are very great. Please [[Technical support|contact us]] and describe your use case so we can help you find a secure solution.
* If you plan to authenticate FTP users (that is, require usernames and passwords)...
** ...a safer and easier alternative is [[SFTP]].
** Another alternative is [https://en.wikipedia.org/wiki/FTPS FTPS], which is an extension of FTP which uses [https://en.wikipedia.org/wiki/Transport_Layer_Security TLS] to encrypt data sent and received.
When authenticating users via passwords, the transmitted data should be encrypted or else an eavesdropper could discover the password. We strongly recommend that you not allow password logins to your VM, as automated brute-force attempts to crack passwords can be expected on any machine connected to the internet. Instead, use ssh-key authentication (see [[SSH Keys]]). [[SFTP]] can be configured to use ssh-key authentication.


; Anonymous FTP :
=Setting up FTP= <!--T:4-->
:; Read Only: Use HTTP, see [[Creating a Webserver on CC-Cloud]]
If you do not have freedom to choose an alternative to FTP, see the guide which best matches your operating system:
:; Read/write: Providing anonymous write access to your server is a very bad idea. Anyone could upload a file, with the potential for it to be a malicious script or executable.
; Authenticated FTP: If you are authenticating FTP users, a better and easier alternative is [[SFTP]].<br/>Another alternative is [https://en.wikipedia.org/wiki/FTPS FTPS], which is an extension of FTP which uses [https://en.wikipedia.org/wiki/Transport_Layer_Security TLS] to encrypt data sent and received. When authenticating users via passwords the transmitted data should be encrypted or else there is a possibility that an eavesdropper could discover the password. In addition it is generally a bad idea to allow password logins on your VM as there are often many automated brute-force password attempts made on any machine connected to the internet. Instead use ssh-key authentication (see [SSH Keys]). [[SFTP]] can be configured to use ssh-key authentication.
 
=Setting up FTP=
If you do not have freedom to choose an alternative see one of the below guides which best matches your operating system
*[https://help.ubuntu.com/lts/serverguide/ftp-server.html Ubuntu guide]
*[https://help.ubuntu.com/lts/serverguide/ftp-server.html Ubuntu guide]
*[https://www.digitalocean.com/community/tutorials/how-to-set-up-vsftpd-on-centos-6--2 CentOS 6 guide]
*[https://www.digitalocean.com/community/tutorials/how-to-set-up-vsftpd-on-centos-6--2 CentOS 6 guide]
The ports that FTP uses must be open on your VM (see [[OpenStack#Security Groups]] for information about opening these ports into your VM). FTP uses port 21 to initiate file transfer requests, but the actual transfer can take place on a randomly chosen port above port 1025, though the details of this can vary depending on the mode with which FTP operates in, for example Port 20 can also be involved (see this [http://www.techrepublic.com/article/how-ftp-port-requests-challenge-firewall-security/5031026/ article] for more details on ports used by FTP). This means that to allow FTP access on your VM you must open port 21 and very likely also ports 1025 and above. This large range of open ports is part of the reason other protocols are preferred to FTP.
The ports that FTP uses must be open on your VM; see [[Managing_your_cloud_resources_with_OpenStack#Security Groups | this page]] for information about opening ports. FTP uses port 21 to initiate file transfer requests, but the actual transfer can take place on a randomly chosen port above port 1025, though the details of this can vary depending in which mode FTP operates. For example, port 20 can also be involved. This means that to allow FTP access on your VM, you must open port 21, possibly port 20, and probably ports 1025 and above. Every open port represents a security risk, which is why other protocols are preferred to FTP. See [http://www.techrepublic.com/article/how-ftp-port-requests-challenge-firewall-security/5031026/ this article] for more details on ports used by FTP.  


[[Category:CC-Cloud]]
<!--T:5-->
[[Category:Cloud]]
</translate>
</translate>

Latest revision as of 21:22, 6 July 2023

Other languages:

Parent page: Cloud

Better alternatives to FTP[edit]

If you have the freedom to choose an alternative to FTP, consider the following options:

  • If you are considering anonymous FTP...
    • ...for read-only access : Use HTTP (see Creating a web server on a cloud).
    • ...for read/write access: The security risks of accepting anonymous incoming file transfers are very great. Please contact us and describe your use case so we can help you find a secure solution.
  • If you plan to authenticate FTP users (that is, require usernames and passwords)...
    • ...a safer and easier alternative is SFTP.
    • Another alternative is FTPS, which is an extension of FTP which uses TLS to encrypt data sent and received.

When authenticating users via passwords, the transmitted data should be encrypted or else an eavesdropper could discover the password. We strongly recommend that you not allow password logins to your VM, as automated brute-force attempts to crack passwords can be expected on any machine connected to the internet. Instead, use ssh-key authentication (see SSH Keys). SFTP can be configured to use ssh-key authentication.

Setting up FTP[edit]

If you do not have freedom to choose an alternative to FTP, see the guide which best matches your operating system:

The ports that FTP uses must be open on your VM; see this page for information about opening ports. FTP uses port 21 to initiate file transfer requests, but the actual transfer can take place on a randomly chosen port above port 1025, though the details of this can vary depending in which mode FTP operates. For example, port 20 can also be involved. This means that to allow FTP access on your VM, you must open port 21, possibly port 20, and probably ports 1025 and above. Every open port represents a security risk, which is why other protocols are preferred to FTP. See this article for more details on ports used by FTP.

File Transfer Protocol

HyperText Transfer Protocol

Retrieved from "https://docs.alliancecan.ca/mediawiki/index.php?title=FTP_server_in_the_Cloud&oldid=140164"