Home / server / Questions / 258634
Accepted
firefusion
Asked: 2011-04-12 23:38:09 +0800 CST

Which is the better connection method? SFTP vs FTPS/ES

  • 772

A friend of mine says giving people SFTP and therefore jailed shell access is a bad idea. However, I think you need a port open for FTPES to work though.

Which is the better connection method?

sftp ftpes

2 Answers

  1. It's perfectly possible to give someone SCP/SFTP-access without giving them a shell.

    What I like about SFTP:

    • Strictly defined standard
    • No need for a DATA connection
    • The connection is always secured
    • The directory listing is uniform and machine-readable
    • Permissions, attribute manipulation, file locking, ...

    What I like about FTPS:

    • Widely known and used
    • Easy to understand what is going on
    • Transmission Server-to-Server
    • X.509 certificate features
    • FTP and SSL/TLS support is built into many browsers, FTP-Clients,...

    Depends on what you think is important...

    • 3
  2. Best Answer

    You can use the ChrootDirectory and "Subsystem internal-sftp" directive to constrain user without giving them any possibility of starting a shell. There is no reason why it should be less secure than FTPS. You should also disable TCPForwarding and related options.

    Ideally, you could have a different sshd process doing SFTP-only on a different port or interface to strongly differentiate from admin ssh. This is needed when running RHEL5 IIRC because it has an older openssh, but on the newer versions there are several more directives to constrain users based on various criterions.

    Your friend is right in one respect: jailed shell access is no good. If you don't do what I just described, and merely chroot the users while allowing them shell access in any way, you are not secure. It is unnecessary nowawadays anyway, so it shouldn't be a problem.

    • 0