Cyberstudy
PDF p.282 In progress

File Transfer Services

Open PDF at p.282 20 flashcards

Summary

PDF p.282

There are various methods for transferring files across networks, including shared folders, email attachments, HTTP, and peer-to-peer services. Despite newer protocols, the File Transfer Protocol (FTP) remains popular due to its efficiency and cross-platform support. However, FTP lacks security mechanisms, making Secure File Transfer Protocol (SFTP) and FTP over SSL (FTPS) preferred for secure file transfers.

In plain words

Supplementary — not from your PDF

FTP is efficient but sends credentials and data in plaintext. SFTP runs over SSH (TCP 22) and encrypts everything. FTPS adds TLS to FTP: explicit (FTPES) upgrades a port-21 connection with AUTH TLS; implicit uses port 990 from the start. FTPES is usually easier with firewalls. Users shouldn't run unauthorized file servers on their PCs.

Detailed explanation

PDF p.282

File Transfer Methods

  • Shared Folders: Hosted by network operating systems for local or remote access.
  • Email and Messaging Apps: Send files as attachments.
  • HTTP: Supports file downloads and uploads.
  • Peer-to-Peer Services: Direct file sharing between users.

File Transfer Protocol (FTP)

  • Configuration: FTP servers host public directories and user accounts. Many HTTP servers also function as FTP servers.
  • Efficiency: More efficient than email attachments or HTTP file transfers.
  • Security Issues: Lacks security; all data and authentication are in plaintext, making it vulnerable to interception.

Unauthorized Servers

  • Rogue Servers: Users should not install unauthorized servers on their PCs. For example, IIS includes HTTP, FTP, and SMTP servers but is not installed by default on client versions of Windows.

Secure File Transfer Protocol (SFTP)

  • Encryption: Encrypts authentication and data transfer using Secure Shell (SSH) over TCP port 22.
  • Secure Link: Creates a secure link between client and server, preventing eavesdropping and on-path attacks.
  • Requirements: Needs an SSH server that supports SFTP and SFTP client software.

FTP Over SSL (FTPS)

  • Explicit TLS (FTPES): Uses the AUTH TLS command to upgrade an unsecure connection over port 21 to a secure one, protecting authentication credentials. Data transfers can also be encrypted using the PROT command.
  • Implicit TLS (FTPS): Negotiates an SSL/TLS tunnel before any FTP commands are exchanged, using secure port 990 for the control connection.
  • Configuration Challenges: FTPS can be tricky to configure with firewalls, making FTPES the preferred method.

Important terms

taken from the text above
Shared Folders
Hosted by network operating systems for local or remote access.
Email and Messaging Apps
Send files as attachments.
HTTP
Supports file downloads and uploads.
Peer-to-Peer Services
Direct file sharing between users.
Security Issues
Lacks security; all data and authentication are in plaintext, making it vulnerable to interception.
Rogue Servers
Users should not install unauthorized servers on their PCs. For example, IIS includes HTTP, FTP, and SMTP servers but is not installed by default on client versions of Windows.
Encryption
Encrypts authentication and data transfer using Secure Shell (SSH) over TCP port 22.
Secure Link
Creates a secure link between client and server, preventing eavesdropping and on-path attacks.
Explicit TLS (FTPES)
Uses the AUTH TLS command to upgrade an unsecure connection over port 21 to a secure one, protecting authentication credentials. Data transfers can also be encrypted using the PROT command.
Implicit TLS (FTPS)
Negotiates an SSL/TLS tunnel before any FTP commands are exchanged, using secure port 990 for the control connection.
Configuration Challenges
FTPS can be tricky to configure with firewalls, making FTPES the preferred method.
FTP File Transfer Protocol SFTP Secure File Transfer Protocol SSH Secure Shell

Examples & real-world scenarios

Supplementary — not from your PDF
  • An SFTP server for partner file exchange.
  • FTPES upgrading a connection on port 21.
  • Removing a rogue FTP service found on a workstation.

Scenario

A supplier still sends invoices by plain FTP. Moving to SFTP protects both the login and the file contents from interception.

Common mistakes

Supplementary — not from your PDF
  • Mixing up SFTP (SSH-based) and FTPS (FTP plus TLS).
  • Getting the ports wrong: SFTP 22, FTPS implicit 990, FTP/FTPES 21.

Practical skills

Supplementary — not from your PDF
  • Choose between SFTP and FTPS for a scenario.

What I should remember

Key Points PDF p.282
  • File Transfer Methods
    • Shared Folders: Local or remote access.
    • Email and Messaging Apps: Attachments.
    • HTTP: Downloads and uploads.
    • Peer-to-Peer: Direct sharing.
  • FTP
    • Configuration: Public directories, user accounts.
    • Efficiency: More efficient than attachments or HTTP.
    • Security Issues: Plaintext data and authentication.
  • Unauthorized Servers
    • Rogue Servers: Avoid unauthorized installations.
  • SFTP
    • Encryption: Uses SSH over TCP port 22.
    • Secure Link: Prevents eavesdropping.
    • Requirements: SSH server and SFTP client.
  • FTPS
    • Explicit TLS (FTPES): Upgrades unsecure connections, port 21.
    • Implicit TLS (FTPS): Uses secure port 990.
    • Configuration Challenges: Prefer FTPES due to firewall issues.