asked on

windows 2003 secure ftp

what would be the best route to take for ftp service on a windows 2003 server machine. I am going to be having information uploaded for websites and want a secure approach to loging into the ftp and transfering data securely... what would be best? Would the ftp program that came with windows 03 server be a wise choice? If not, what other programs should i be looking at...

Nick_Chvr

IIS 6.0. It should be included with your copy of 2k3. You'll have to add the component in add/remove programs. Set the ftp up and allow no anonymous access, only username and pword. You can even put it on a non-standard port besides the usually 21. This will keep mass ftp scanners from hitting your site.

ASKER CERTIFIED SOLUTION

java_programmer

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Leon Fester

Java_programmer is correct, BUT, how secure do you actually want the site to be? Why I'm asking is because on windows 2003 you can configure the ftp site with the following "security" options:
restricted username/password access;
ftp access only allowed from specified IP addresses;
read/write/browse folder access restrictions(on both ftp service configuration as well as on the actual windows folder);
Secure access via a client certificate.

However if it is a requirement for more secure communications (non-clear text transfers) then yeah, I agree with java_programmer, get another FTP service for your communications to the windows 2003 server.

meatdog8

ASKER

Java,

Is running Cygwin on my server secure... sorry i've never heard much about cygwin... I read most everything on their site and did not see anything about security... is cygwin safe to run on a server?

Any other program suggestions for a secure ftp server?

java_programmer

Cygwin is a "unix" environment for Windows. It is as safe as the applications you install/turn on.. for example if you run an old apache under Cygwin, and apache has some vulnerability....

The latest build is SSH is safe and secure, so your server would remain safe and secure. Also a LOT of people use it... do a google on SSH CYGWIN ... I am using it here, my only complaint is the interaction of SSH and windows programs... so if you run cmd within a cygwin shell, you'll lock it... but as standard commands like ps, secure ftp, kill etc are all very reliable.

There are some win32 openssh ports, but they tend to have a lot of issues... There are also commercial windows based ssh setups, but are a bit expensive .... (check out pragma http://www.pragmasys.com/ClientSuite/) $599 USD

Cheers,
Derek

meatdog8

ASKER

java,
thank you very much for your input. sounds like cygwin is the answer to my question...

meatdog8

ASKER

java

where do i create new users/passwords and how do i associate that username with a directory? I'll open another question if you would like for points...

meatdog8

ASKER

I started another quesion.. reguarding the last statement

https://www.experts-exchange.com/questions/21247468/creating-accounts-using-open-ssh-cygwin-and-win2003.html

nealmcdonald

I am in the middle of implementing this thread. I have set up a Win 2k3 Enterprise box and from my research, I heard there's issues with Cygwin on this OS. I would consider using FreeBSD or some Linux OS. This machine will only be performing SFTP to many insecure clients. What is the best approach considering OS's and ease of use for clients?

Thanks... I just signed up today and love this site!

Neal

meatdog8

ASKER

what issues have you heard of? I would like to know... I usually have people download WinSCP to connect to cygwin...