Paul Bauer is the author of the mildly successful technology blog Bauer-Power. Paul has a degree in Computer Networking, as well as several certifications including A+, Network+, Server+, MCP, and WCSE. You can subscribe to Bauer-Power's RSS feed by clicking here:(RSS)
Do you have an FTP server running? Maybe you still use telnet for something on your network. Perhaps, you are a VNC user. Maybe you host your own web server, or POP3 e-mail server. All of the protocols used to make the services on those server work, are unsecured, and can easily be intercepted and/or monitored by third parties.
I already told you about Filezilla in a previous post, which uses FTPS, a secure file transfer protocol, but what if you are a fan of Microsoft's IIS service for running your FTP, or another unsecured FTP server software that still uses ports 20 and 21 and sends your passwords in plain text. Some people just don't like switching their server software. Sometimes due to laziness, and other times because it is too much of a pain.
There is a solution my friends, and it comes in the form of Open Source. It is called STUNNEL. STUNNEL provides a secure wrapper for any unsecured protocol you have, and encrypts the data connection using SSL. Take for instance my web server. Behind my firewall it is listening on port 80. My firewall, however is only open to port 443 (The port https uses). When you type https://pdbauer.com in your browser your traffic on port 443 gets forwarded through my firewall to my web server where STUNNEL is listening for 443 traffic. STUNNEL then forwards that traffic to port 80 where my web server service is listening. The whole process is encrypted using a self signed SSL Certificate I made using OpenSSL. Of course, you can do the same with a purchased certificate from a certificate authority like Comodo, Verisign, Thawte etc.
You can do the same thing to secure your POP3 e-mail, VNC, and FTP servers. There are so many options available with this, it really is a great tool for the security conscientious.
- Related Videos
- Related Articles
- Ask / Related Q&A
- Ftps Secure Ssl File Transfer
- Ftp Servers and Security - Three Methods That Secure Ftp Servers Use
- Ftps (ftp Over Ssl) Vs. Sftp (ssh File Transfer Protocol): What to Choose
- Transferring Files Securely Using FTPS
- Securing Unsecure Protocols
- FTP Basics
- Why Do We Need Free Ftp Software?
- What is an Ftp Transfer? How Do I Use It?
Securing websites
By: MFrizzi | 18/12/2009This paper discusses some of the common ways that web servers are attacked and details various techniques in which they – and by extension the websites they host – can be protected.
Applications, virtualization, and devices: Taking back control
By: MFrizzi | 18/12/2009Employees installing and using legitimate but unauthorized applications, such as Instant Messaging, VoIP, games, virtualization software, and unapproved browsers are a real and growing threat to business security and productivity. Removable storage media and wireless protocols make the challenge of securing data even more complex. This paper explains why it is important to control unauthorized applications and devices, discusses the different approaches, and highlights how integrating this funct
Trend Micro: Koobface Abuses Google Reader
By: Angeline Mabute | 18/12/2009Trend Micro’s threat research revealed that Koobface botnet is abusing Google Reader by spamming URLS which redirects Internet users to infected websites through Youtube.
Trend Micro: Koobface Abuses Google Reader
By: Angeline Mabute | 18/12/2009Trend Micro’s threat research revealed that Koobface botnet is abusing Google Reader by spamming URLS which redirects Internet users to infected websites through Youtube.
PCI Penetration Testing. ASV, QSA, Internal, Third-party?
By: George Pettit | 17/12/2009As a Qualified Security Assessor Company (QSAC) we often get asked by our clients if they are able to fulfil their ongoing PCI penetration testing requirements in-house. The short answer is it depends. PCI DSS requirement 11.3 covers an organisations requirement for conducting an annual internal and external penetration test – including application tests.
Silon Malware Steals your Credentials
By: Angeline Mabute | 17/12/2009Trusteer warns the people on a new Trojan called Silon which can intercept user’s web login activities targeting Internet Explorer users.
How to Remove Malware from Your Computer
By: Hannah Miller | 17/12/2009If you suspect your computer has become infected with some sort of virus or spyware, you should take action immediately. The longer a virus is on your computer the more it will spread and could attack core system files or your personal files. The longer spyware is on your computer the more likely you are to have computer problems and, even worse, identity theft. Here is an in-depth explanation on what should be done.
Parental Control Keylogger
By: Data recovery | 16/12/2009Keyboard surveillance tool invisibly monitors typed text URL, clipboard contents, system startup date, time, session, chat conversations, sending mails, windows captions etc. Software easily tracks your employee online activities in your absence.
Is There Such a Thing as a Digg Strategy?
By: Paul Bauer | 27/11/2007 | BloggingI have been using Digg.com for quite a while now, and have only recently begun to understand how it is that Digg really works. So many times I have submitted a blog post, only to get one or two diggs, then have it fall off into oblivion.
Is Google's Gmail Secure?
By: Paul Bauer | 12/11/2007 | EmailIf you browse to Google's email interface, you may noticed that it defaults to http://mail.google.com and not to httpS://mail.google.com. What does that mean? You may ask. It means your e-mail is not secured.
Securing Unsecure Protocols
By: Paul Bauer | 12/11/2007 | SecurityDo you have an FTP server running? Maybe you still use telnet for something on your network. Perhaps, you are a VNC user. Maybe you host your own web server, or POP3 e-mail server. All of the protocols used to make the services on those server work, are unsecured, and can easily be intercepted and/or monitored by third parties.
Open Source E-mail Encryption
By: Paul Bauer | 11/11/2007 | SecurityPGP, or more specifically OpenPGP is a great, and more importantly FREE method of securing your data and your e-mails. You don't want "The Man" reading your e-mails, and neither do I.