Jump to content


Photo

How to ensure passwords are not sent in clear text


This topic has been archived. This means that you cannot reply to this topic.
3 replies to this topic

#1 vallelunga

vallelunga
  • Members
  • 8 posts

Posted 28 March 2003 - 06:13 PM

I probably should have posted this before buying our 10 or so licenses :oops:

My company needs to make sure that our passwords are not sent in clear text. We don't care about encrypting the data; just the password during the connection phase. Is Smart FTP capable of this or do I need to install something on our server.

We are using a Sun Cobalt RaQ3 server appliance which supposedly supports 56bit SSL and SSH.

Thanks,
John Vallelunga, Agilent Technologies

#2 Louie

Louie
  • Members
  • 337 posts

Posted 28 March 2003 - 06:51 PM

SmartFTP does support SSL, and when connecting to the SSL enabled server, the password is encrypted at the front door.

So the answer to your question is "Yes". SmartFTP encrypts the password as it's being sent to the remote server.

#3 mike808

mike808
  • Members
  • 5 posts

Posted 02 April 2003 - 03:47 PM

You will also need to be using an FTP server that uses SSL. There are two major ways this has been implemented.

One is called "implicit" SSL-enabled FTP. This works like HTTPS does, in that everyone assumes that all connections are always SSL-encrypted. It is usually assigned to run on port 900 (instead of 21 for control) and port 899 (instead of 20 for data).

The other, standardized way is called "explicit" SSL, and follows RFC 2228. It uses new FTP commands (e.g. AUTH TLS, PBSZ 0, and PROT P) to manage the encryption (SSL aka TLS).

SmartFTP can connect to either type of server.

The major task you have before you is getting your FTPS server running. An SSL-aware client like SmartFTP cannot magically "make" your server become SSL-aware. There are many servers to choose from and many of them are available for non-Microsoft servers as well.

See http://www.ford-hutc...h/ftps-ext.html for all of the options available to you.

Michael

#4 Louie

Louie
  • Members
  • 337 posts

Posted 02 April 2003 - 06:01 PM

Thanks Mike, very nice explanation ;)