August 22, 2008

Bad FTP!! Go lie down!

FTP has been around for a while. The core functionality for FTP was drafted back in 1972, which in itself isn'€™t that bad as that's when most of the foundation for internet technologies were drafted. But FTP hasn'€™t changed much to keep up with other technologies around it. It'€™s outdated and insecure and you should refuse to use it as a client and ask for it to be removed from you server. Here'€™s why...

Inconsistent standards

So many servers do things differently and clients are trying to accommodate all of them. Over the years small advances have been added here and there to different servers and the standard, creating inconsistencies. These inconsistencies lead to dropped connections, poor upload speeds, and worst of all, security holes on your server.

Insecure and unencrypted

Passwords are sent over the tubes in plain text. This means devilish hackers sitting on the tubes can see your password go by, snatch it and use it to access your files. Not only is your password not encrypted, but all files sent, including web app config files that contain your database passwords etc., are sent plain text as well.

Too many ports

FTP servers use ports 20 and 21, but after the initial connection is made the client can create connections on the usual FTP ports between 49152 and 65335 which means your server now has 15,000+ open ports. Open ports equal security risks. On top of that, each time a new file is transferred a connection to a specific port is obtained and then trashed when file transfer is complete which creates latency when transferring large numbers of small files.

So what can i do?

Grab WinSCP (Windows) or CyberDuck (OSX) and connect and browse files through SSH. Educate your clients and make sure SSH is available to them on whatever host they sign up with. It'€™s safe, secure, consistent and uses port 22 which is the same port you would use to connect to for shell access. At the very least use FTPS which is plain old FTP with some encryption thrown in. Not ideal, but will do the job until you can switch to SCP over SSH.