ArticlesBase.com - Free Articles Directory
Free Online Articles Directory
20.05.2008 Sign In Register Hello Guest
Email:
Password:
Remember Me 
forgot your password?


Ftps (ftp Over Ssl) Vs. Sftp (ssh File Transfer Protocol): What to Choose

Author: Eugene Mayevski | Posted: 14-10-2007 | Comments: 0 | Views: 96 | Got a Question? Ask.
Sign Up Now!
Eugene Mayevski

File transfer over the network using FTP protocol (defined by RFC 959 and later additions) takes roots in year 1980, when the first RFC for FTP protocol was published. FTP provides functions to upload, download and delete files, create and delete directories, read directory contents. While FTP is very popular, it has certain disadvantages that make it harder to use. The major drawbacks are lack of the uniform format for directory listing (this problem has been partially solved by introducing MLST command, but it's not supported by some servers) and presence of the secondary connection (DATA connection). Security in FTP is provided by employing SSL/TLS protocol for channel encryption as defined in RFC 2228. The secured version of FTP is called FTPS.

In UNIX systems another security standard has grown. It was SSH family of protocols. The primary function of SSH was to secure remote shell access to UNIX systems. Later SSH was extended with file transfer protocol - first SCP (in SSH 1.x), then SFTP (in SSH2). Version 1 of the SSH protocol is outdated, insecure and generally not recommended for use. Consequently SCP is not used anymore and SFTP gains popularity day by day.

"SFTP" abbreviation is often mistakenly used to specify some kind of Secure FTP, by which people most often mean FTPS. Another (similar) mistake is that SFTP is thought to be some kind of FTP over SSL. In fact SFTP is an abbreviation of "SSH File Transfer Protocol". This is not FTP over SSL and not FTP over SSH (which is also technically possible, but very rare).

SFTP is a binary protocol, the latest version of which is standardized in RFC 4253. All commands (requests) are packed to binary messages and sent to the server, which replies with binary reply packets. In later versions SFTP has been extended to provide not just file upload/download operations, but also some file-system operations, such as file lock, symbolic link creation etc.

Both FTPS and SFTP use a combination of asymmetric algorithm (RSA, DSA), symmetric algorithm (DES/3DES, AES, Twhofish etc.) and a key-exchange algorithm. For authentication FTPS (or, to be more precise, SSL/TLS protocol under FTP) uses X.509 certificates, while SFTP (SSH protocol) uses SSH keys.

X.509 certificates include the public key and certain information about the certificate owner. This information lets the other side verify the integrity of the certificate itself and authenticity of the certificate owner. Verification can be done both by computer and to some extent by the human. X.509 certificate has an associated private key, which is usually stored separately from the certificate for security reasons.

SSH key contains only a public key (the associated private key is stored separately). It doesn't contain any information about the owner of the key. Neither it contains information that lets one reliably validate the integrity and authenticity. Some SSH software implementations use X.509 certificates for authentication, but in fact they don't validate the whole certificate chain - only the public key is used (which makes such authentication incomplete and similar to SSH key authentication).

Here's the brief list of Pros and Cons of the two protocols:

FTPS

Pros:
 Widely known and used
 The communication can be read and understood by the human
 Provides services for server-to-server file transfer
 SSL/TLS has good authentication mechanisms (X.509 certificate features)
 FTP and SSL/TLS support is built into many internet communication frameworks.

Cons:
 Doesn't have a uniform directory listing format
 Requires a secondary DATA channel, which makes it hard to use behind the firewalls
 Doesn't define a standard for file name character sets (encodings)
 Not all FTP servers support SSL/TLS
 Doesn't have a standard way to get and change file and directory attributes

SFTP

Pros:
 Has good standards background which strictly defines most (if not all) aspects of operations
 Has only one connection (no need for DATA connection)
 The connection is always secured
 The directory listing is uniform and machine-readable
 The protocol includes operations for permission and attribute manipulation, file locking and more functionality

Cons:
 The communication is binary and can't be logged "as is" for human reading
 SSH keys are harder to manage and validate
 The standards define certain things as optional or recommended, which leads to certain compatibility problems between different software titles from different vendors.
 No server-to-server copy and recursive directory removal operations
 No built-in SSH/SFTP support in VCL and .NET frameworks

What to choose

As usually, the answer depends on what your goals and requirements are. In general, SFTP is technologically superior to FTPS. Of course, it's a good idea to implement support for both protocols, but they are different in concepts, in supported commands and in many other things.

It's a good idea to use FTPS when you have a server that needs to be accessed from personal devices (smartphones, PDAs etc.) or from some specific operating systems which have FTP support but don't have SSH / SFTP clients. If you are building a custom security solution, SFTP is probably the better option.

As for the client side, the requirements are defined by the server(s) that you plan to connect to. When connecting to Internet servers, SFTP is more popular because it's supported by Linux and UNIX servers by default.

For private host-to-host transfer you can use both SFTP and FTPS. For FTPS you would need to search for a free FTPS client and server software or purchase a license for commercial one. For SFTP support you can install OpenSSH package, which provides free client and server software.

Developer tools

If you are a software developer and need to implement file transfer capability in your application, you will be searching for the components to do the job.

In .NET you have built-in support for FTPS in .NET Framework (see FtpWebRequest class). However functionality of this class is severely limited, especially in SSL/TLS control aspect.
.NET Framework doesn't include any support for SSH or SFTP.

In VCL you have a selection of free components and libraries which provide FTP functionality. When you add OpenSSL to them, you can get FTPS for free. If you don't want to deal with OpenSSL DLLs, you can use one of the commercially available libraries for SSL and FTPS support. Again, there are no freeware SFTP components available for VCL.

If you use a tool with which you have to use ActiveX controls, you need to search for commercial FTPS or SFTP controls. No free controls are available.

SecureBlackbox library provides both FTPS and SFTP support for .NET, VCL and ActiveX technologies.

Rate this Article:

Article Tags: FTP, Component, Control, Library, Ssh, Ssl, Net, Sftp, Ftps, Vcl

Article Source: http://www.articlesbase.com/security-articles/ftps-ftp-over-ssl-vs-sftp-ssh-file-transfer-protocol-what-to-choose-235545.html

Print this Article Print article   Email to a Friend Send to friend   Publish this Article on your Website Publish this Article   Send Author Feedback Author feedback  
About the Author:

Eugene Mayevski takes a post of Chief Technical Officer in EldoS Corporation (www.eldos.com), the company that specializes in development of security and low-level system components for software developers.
SecureBlackbox (www.SecureBlackbox.com) is the product of EldoS Corporation that provides SFTP and FTPS support for .NET and VCL frameworks.

Submitting articles has become one of the most popular means of generating quality backlinks and targeted traffic to your website. Join us today - It's Free!

Article Comments

Comment on this article Comment on this article
Your Name
Your Email:
Comment Body
Enter Validation Code: Captcha


Related Articles

Securing Unsecure Protocols
By: Paul Bauer | 12/11/2007 | Security
Do you have an FTP server running? Maybe you still use telnet for something on your network. Perhaps, you are a VNC user. Maybe you host your own web server, or POP3 e-mail server. All of the protocols used to make the services on those server work, are unsecured, and can easily be intercepted and/or monitored by third parties.

Internet Communication Made Easy for .net Developers
By: Alexandre Poloziouk | 03/12/2007 | Software
Save time developing efficient and clean client-server products in .NET environment with pure managed .NET code with client and server components for FTP, SMTP, and POP3 protocols.

Gbs or Tetrabytes Data Server to Server Transfer on Linux
By: Naqi Khan | 31/12/2007 | Web Hosting
GBs or Tetrabytes data server to server transfer on linux

6-in-1 Ssl Certificate
By: AturDoorStep | 02/06/2007 | Internet
24hrsdomain.com INTRODUCES 6-IN-1 SSL CERTIFICATE New Offering Enhances Web Site Security, Savings & Customer Confidence

Why is the Core Important to Golf?
By: Sean Cochran | 20/09/2005 | Golf
In this section of the body and 2) the core is an integral part of all human movement, including your swing! Let us first review the first point in terms.

The Power That Controls Our Lives
By: Barbara White | 19/09/2005 | Self Help
At these foundational things that have governed us all our lives. These foundations are our beliefs and our values. They color our lives even though we may not be aware.

The Humble TV Remote Control: Friend Or Foe?
By: | 30/03/2006 | Art and Entertainment
I've personally witnessed otherwise peaceful families break into literal wars over mundane and often, nondescript issues. We too have out warring subject. In our house, the TV remote control is the biggest cause of strife.

Control Your Legacy with a Private Foundation
By: Robert Valentine | 19/10/2006 | Finance
Private foundations can let you control your gifts, reduce taxes and impart your values to future generations.

Got a Question? Ask.

Ask the community a question about this article:

Frequently Asked Questions

Problem switching to OUTLOOK 2007 from OUTLOOK EXPRESS
By: TexBigR | 07-05-2008
I switched from outlook express to outlook 2007. Using the tutorials, I got some of my messages, but not all of them. None of my contacts imported. I also spent 1 hour in a chat box with my ISP to setup outlook 2007 to send and receive messages. The final result is that I can receive but not send. I keep getting an error saying it can't open the output server. The tech gave up saying all the settings are correct. HELP!!!!!!!!!!!

"Control" soundtrack
By: ilan.peer | 27-04-2008
in the movie "Control" what song is playingwhen Ian walks out of the house to workwearing the Hate jacket?i know it's a Joy Division song..which one is it though?  

Pls let me know how to Covert string to int value ...
By: Gowri | 24-04-2008
Pls let me know how to Covert string to int value and add it , codings in VB.net

I was checking my bank statement and found several ...
By: RENGREEN | 23-04-2008
I was checking my bank statement and found several unauthorized MAC machinewithdrawals from my account. My MAC card was on my person at each of the times the transactions were made. Is there a way that someone could duplicate my card and access my pin # without my knowledge?

How can i test SSL certificates
By: dcecil92127 | 22-04-2008
how can i test SSL certificates

What's the best OS upgrade for a MAC G3?
By: raincheckhero | 22-04-2008
Hi. I'm new in the MAC society, and i was given this MAC G3 - the blue one. I wanted to keep it, and upgrade it. What would be the best MAC OS that it can handle? currently it's on 9.2, and I find it outmoded.. And it would even allow most MAC stuff that I have. Any answer would help. Thanks!

Q&A Powered by:
Powered by Yedda 

Latest Security Articles

The Enemy Within
By: Sandra Prior | 20/05/2008
Like their biological counterparts, computer viruses cannot replicate by themselves – they must attach themselves to an existing computer program so they can be copied along with it. There are 3 main types of viruses, each of which use a different kind of host.

Computer Fires: How Vulnerable is Your Pc?
By: Richard n Williams | 20/05/2008
This article explains the potential devestating fires that can be caused by computers and monitors and the best ways of combating them.

Dust: the Computer Killer
By: Richard n Williams | 19/05/2008
This articel explains how to protect your IT from the harmful effects of dust.

Gafana - Anti-spam System Review
By: Ole T | 19/05/2008
How much time do we spend cleaning our mailboxes and racking our brains over removing the newly-arrived viruses from our computers. That's the way it is in modern Internet life. But it can be easily improved with the new spam-blocking technologies by Gafana. Gafana.com is a spam-blocking mail system.

Computer Security: How You Can Improve Yours
By: Craig Thornburrow | 16/05/2008
Computer security is a branch of information technology that relates specifically to measures taken to protect the data on computers from being corrupted or misused. Computer security comes in a myriad of different forms depending on what level of protection is required.

Download Free Spyware Removal Software and Protect Your Pc
By: Arvind | 16/05/2008
Free spyware removal software is widely available over the internet. You can download any one of these to keep your PC protected from the spywares.

Securing Your Computer System
By: Shirley Margriet | 16/05/2008
Today, more and more people are using their computers for everything from communication to online banking and investing to shopping. As we do these things on a more regular basis, we open ourselves up to potential hackers, attackers and crackers.

It Outsourcing Companies Provide Services Round the Clock
By: Wade | 13/05/2008
It is great to see so many different ways of business have benefitted from the Internet. One of the benefits has been the ease of outsourcing. Now you can outsource almost everything to the experts, thus save time and money…not to forget peace of mind.

Article Categories



Creative Commons License




Give Feedback

Sign up for our email newsletter

Receive updates, enter your email below