Encrypt fxp transfers?

[asother00]

some friend of mine was telling me to ask around (these are his words), because I had no idea who to ask, so I figured I would here... anyways:

there is no encrypted variant of the FTP protocol out currently
of which i am aware that supports encrypted site to site transfers

the only solution that i can envision is to use an encrypted wrapper on the unencrypted ftp session which is where a VPN or PPTP comes in

do you know if there is a way to encrypt fxp transfers?
because flashfxp, even w/ authTLS doesnt encrypt fxp
ssl/tls doesnt do fxp transfers only
direct transfers
it's a sftp protocol issue

Is there now a ftp server that allows for encrypted fxp transfers?

from what i understand fxp transfers can be encrypted if the person sending makes a vpn tunnel

I don't know of anyone to ask these questions.

[Linkster]

you are correct....and this is exactly why ioftpd has "disabled" the abilty to do fxp with auth ssl...it gives people a false sense of security. as far as I know, there is not a single server out there that supports server to server transfers encrypted. I believe ioftpd is still working on a solution.

[Bunk0]

dose't raidenftpd's(and many other ftpds) implementation of sscn do what you are asking?

http://www.raidenftpd.com/kb/kb000000037.htm

[Linkster]

yes, but SSCN still has a design flaw...see this thread:

http://www.ioftpd.com/board/showthre...&threadid=1967

[Hetfield]

This isn't entirely fair IMHO. Of course, FXP SSL transfers are vulnerable to "man in the middle attacks", for the reasons described by DarkOne in that thread. But the same goes for *every* normal SSL transfer too because you can never be sure that the certificate you get from the FTP server is indeed the certificate the server has sent to you. You should have a trusted third party to do the signing etc, but even then it's not 100% secure. Besides this, a "man in the middle attack" really is not easy, almost impossible even, and AFAIK never be seen "in the wild". Therefore i would say SSL FXP is much safer then no encryption at all, and definitely not a reason to say it's almost the same as no encryption at all. Just my 2 cents.

[Linkster]

Hetfield...i would have to agree with you...you can definitely look forward to ioftpd supporting it in some fashion in the near future.