FTP server in the Cloud: Difference between revisions

There are two main ways that an FTP server can be configured, anonymous access, or authenticated access. In both case there are better alternatives. If you require anonymous FTP you really should only allow read access to the files, otherwise anyone could upload malicious files to your server which is a very big security vulnerability. A better alternative to anonymous FTP with read access is HTTP which can allow the public to download files from your server (see for example [[Creating a Webserver on CC-Cloud]]). If on the other hand you wish to have authenticated FTP, a much better option is to use SFTP (see [[Transferring files#From your personal computer]]), which uses the SSH protocol and can easily work with [[Ssh keys|ssh key]] authentication and is already configured to work on Linux VMs. There is also an encrypted version of FTP, FTPS (different from SFTP) which uses [[Configuring Apache to use SSL | SSL certificates]] for encryption rather than ssh keys.  Another issue with using authenticated FTP on Compute Canada cloud is that in most cases the FTP daemon maps authentication credentials to system accounts. This requires the associated system account to have a password which is against the cloud Acceptable Usage Policy which states that users may only access VMs with key-pair authentication. If there is still a good reason to use FTP over one of the alternatives given above see the linked to guides below on how to setup FTP on a VM. One issue to keep in mind is the ports that FTP uses, FTP uses port 21 to initiate file transfer requests, but the actual transfer can take place on a randomly chosen port above port 1025, though the details of this can vary depending on the mode with which FTP operates in. This means that to allow FTP access on your VM you must open port 21 and very likely also ports 1025 and above (see [[OpenStack#Security Groups]] for information about opening these ports into your VM). This large range of open ports is part of the reason other protocols are preferred to FTP.

 

 

; Authenticated FTP: If you are authenticating FTP users, a better and easier alternative is [[SFTP]].<br/>Another alternative is [https://en.wikipedia.org/wiki/FTPS FTPS], which is an extension of FTP which uses [https://en.wikipedia.org/wiki/Transport_Layer_Security TLS] to encrypt data sent and received. When authenticating users via passwords the transmitted data should be encrypted or else there is a possibility that an eavesdropper could discover the password. In addition it is generally a bad idea to allow password logins on your VM as there are many automated brute-force password attempts made on any machine connected to the internet. Instead use ssh-key authentication (see [Ssh keys]). [[SFTP]] can be configured to use ssh-key authentication (if form windows see [Connecting with MobaXTerm], if connecting from Linux see .