Page 347 - StudyBook.pdf

Communication Security: Web Based Services • Chapter 5 331

its ephemeral port to connect to the ephemeral port of the server. Because the
client has initiated both connections, the firewall on the client machine doesn’t
block the connection, and data can now be transferred between the two machines.

S/FTP

S/FTP is a secure method of using FTP. It is similar to Secure Shell (SSH) which is
a solid replacement for Telnet. S/FTP applies the same concept: added encryption
to remove the inherent weakness of FTP where everything is sent in cleartext.
Basically, S/FTP is the FTP used over SSH. S/FTP establishes a tunnel between the
FTP client and the server, and transmits data between them using encryption and
authentication that is based on digital certificates.A S/FTP client is available for
Windows, Macintosh OS X, and most UNIX platforms.A current version can be
downloaded at www.glub.com/products/secureftp/.
While FTP uses ports 20 and 21, S/FTP doesn’t require these. Instead, it uses
port 22, which is the same port as SSH. Since port 20 and port 21 aren’t required,
an administrator could actually block these ports and still provide the ability of
allowing file transfers using S/FTP.
Another consideration when sharing data between partners is the transport
mechanism.Today, many corporations integrate information collected by a third
party into their internal applications or those they provide to their customers on
the Internet. One well-known credit card company partners with application ven-
dors and client corporations to provide data feeds for employee expense reporting.
A transport method they support is batch data files sent over the Internet using
S/FTP. S/FTP is equivalent to running regular, unencrypted FTP over SSH.
Alternatively, regular FTP might be used over a point-to-point VPN.

NOTE

Although S/FTP is covered in the Security+ exam, another secure method
of transferring files that is not mentioned is Secure Copy Protocol (SCP).
SCP is the secure equivalent of the Remote Copy Protocol (RCP), and
uses SSH for providing secure file transfers between clients and servers.
Because of this, a major difference between SCP and RCP is that files are
encrypted during transfer. Also, S/FTP should not be confused with the
Simple File Transfer Protocol (SFTP), which was a FTP that provided no
security, and never gained any popularity. Simple File Transfer Protocol is
often referred to as SFTP, which is why Secure FTP is named S/FTP to
indicate it is two different protocols. Unlike S/FTP, which uses port 22,
SFTP used port 115.

www.syngress.com