FTP for document distribution

[Aussie John]

Im wondering if anyone uses FTP ( file transfer protocol) for document distribution. If they are would like their comments. Is it secure enough?

[Gerald Hoffman]

John,

I recently acquired FTP space and have found it to be excellent for transferring drawings and storing backup copies etc. I set up discreet folders for the different consultants and give them their own passwords. As for security, I think it is pretty good and you can increase it by encrypting compressed files with password protection on these as well. It solves large file attachment issues as I frequently have PDF drawings sets of 20 Mb. or so.

Cheers,
Gerald

[Aussie John]

We are looking to set up our own FTP site but am a little concerned about security and being able to access the main network

[Ralph Wessel]

Aussie wrote:
We are looking to set up our own FTP site but am a little concerned about security and being able to access the main network

Are you planning to set this up on an in-house server? If so, what is your server configuration?

Enabling distribution through FTP should not be a problem providing you set up access privileges correctly, e.g. make sure you don't have guest access to sensitive areas. The main problem with FTP is that login details are handled as clear text (i.e. human-readable). A knowledgeable person could intercept this information. Alternatives are SFTP or FTPS. However, is it very likely that someone would be interested in cracking into your network and have the necessary skills to do it?

Also consider the 'traditional' problems associated with document distribution; How do you know who has received which files, and when? Can you prove it if a dispute arises? How will you ensure the right people are notified of updates?

[Anonymous]

We tried this some. The other issues to consider besides security are general password management tools and compatibility with Project Publisher. I tried supporting a system in-house for a while using a static TCPIP address on our DSL line when we were running OS9. It turned out that the WebStar Server product would not talk to Project Publisher and managing user passwords was a pain.

I am sure there are tools that work for this. It may be worth looking at off-site services if the management tools are good. I would like to have a site myself, but just haven't gotten back to it.

[Anonymous]

this might be an alternative if the problem is large files

http://www.yousendit.com/



bill

[TomWaltz]

We're using HTTP to transfer files, on and Apache server for licensing/authentication.

Users can download from any browser, using logins and passwords we provide. We have a dedicated server on a full T1 line.

[Aussie John]

TomWaltz wrote:
We're using HTTP to transfer files, on and Apache server for licensing/authentication.

Users can download from any browser, using logins and passwords we provide. We have a dedicated server on a full T1 line.

Tom do yu have any more info on this? thanks

[Aussie John]

Ralph wrote:
Are you planning to set this up on an in-house server? If so, what is your server configuration?

we use and xsever running OS X 10.3 server. We also have a VPN network to a remote site.

[Ralph Wessel]

Aussie wrote:

Ralph wrote:
Are you planning to set this up on an in-house server? If so, what is your server configuration?

we use and xsever running OS X 10.3 server. We also have a VPN network to a remote site.

Apple provides excellent documentation on all this, which will walk you through the process of configuring Mac OS X server. The latest online documents relate to 10.4, but you should have equivalents for 10.3. The section relating to FTP is at http://images.apple.com/server/pdfs/File_Services_v10.4.pdf

The main security issues with FTP are:
- don't allow anonymous logins, especially for uploading
- FTP logins are sent as clear-text (unencrypted), which means they can potentially be intercepted and read.
- Mac OS X has a separate share point for FTP, which helps to protect the rest of your network. Even if an unauthorised does somehow obtain login details, they won't automatically have access to everything.