Page 348 - StudyBook.pdf
P. 348
332 Chapter 5 • Communication Security: Web Based Services
Secure Copy
Secure Copy (SCP) has become a preferred method of transferring files by security
professionals. SCP uses SSH to transfer data between two computers, and in doing
so provides authentication and encryption.A client connects to a server using SSH,
and then connects to an SCP program running on the server.The SCP client may
also need to provide a password to complete the connection, allowing files to be
transferred between the two machines.
The function of SCP is only to transfer files between two hosts, and the
common method of using SCP is by entering commands at the command prompt.
For example, if you were to upload a file to a server, you would use the following
syntax:
scp sourcename user@hostname:targetname
For example, lets say you had an account named bob@nonexist.com, and were
going to upload a file called myfile.txt to a server, and wanted it saved in a directory
called PUBLIC under the same name. Using SCP, you would enter:
scp myfile.txt bob@nonexist.com:PUBLIC/myfile.txt
Similarly, if you were going to download a file from an SCP server, you would
use the following syntax to download the file:
scp user@hostname:sourcefile targetfile
Therefore, if you were going to download the file we just uploaded to a direc-
tory called mydirectory, you would enter:
scp bob@nonexist.com:/PUBLIC/myfile.txt /mydirectory/myfile.txt
While users of SCP commonly use the command-line, there are GUI programs
that also support SCP. One such program is WinSCP, which supports FTP, S/FTP
and SCP.This program is open source, and available as a free download from
www.winscp.net. It provides a means for users who aren’t comfortable with
entering commands from a prompt to use SCP, or those who simply prefer a
graphical interface to perform actions over the Internet or between intranet hosts
where security is an issue.
Blind FTP/Anonymous
FTP servers that allow anonymous connections do so to allow users who do not
have an account on the server to download files from it.This is a common method
www.syngress.com
