bbcac
asked on
Creating an FTP script to move a file with specifying domain account credentials. Certificates the asnwer?
We have an FTP server that is running on a DMZ system. In the past we have created FTP.exe based scripts that move files from the FTP server to a share on the network somewhere. In order to do this we have created reduced privledge accounts that have liimted access and explicitly put the username and password in the script.
We can no longer do this. We need some way of automating the ftp transfer without specifiying credentials. One of the security guys mentioned certificates as a possilbe solution.
Can some one please provide me with instructions on going about this?
FTP server is a proprietary server
Both Boxes are windows 2003
I am using windows ftp.exe but I can change that.
Thanks in advance.
We can no longer do this. We need some way of automating the ftp transfer without specifiying credentials. One of the security guys mentioned certificates as a possilbe solution.
Can some one please provide me with instructions on going about this?
FTP server is a proprietary server
Both Boxes are windows 2003
I am using windows ftp.exe but I can change that.
Thanks in advance.
ASKER
We cannot trasmit the password in clear text or hard code the password anywhere. What do you suggest then?
Um.
So you want to create a script to log into FTP that doesn't supply the password at all - I would assume this would include both the FTP password and a password for the private key of a user certificate...
What if the script called a file that was stored in encrypted format under the script user's context (i.e. the user account the script uses has an EFS certificate or something similar that won't prompt for a pin, and is then used to decrypt a password file for either FTP session or certificate PIN)?
That's about all I got from my understanding of your requirements... Might see if you can request attention to add to 2 more programming zones...
So you want to create a script to log into FTP that doesn't supply the password at all - I would assume this would include both the FTP password and a password for the private key of a user certificate...
What if the script called a file that was stored in encrypted format under the script user's context (i.e. the user account the script uses has an EFS certificate or something similar that won't prompt for a pin, and is then used to decrypt a password file for either FTP session or certificate PIN)?
That's about all I got from my understanding of your requirements... Might see if you can request attention to add to 2 more programming zones...
You would still need to connect to the sftp which would require a password. I suppose you could use putty to store the password for the SSH session, if that is acceptable.
ASKER
My security team has recommeneded using self signed certificates. Is this viable? or do they not have any idea what they are talking about.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
What about using a private/public key method. We have tested this here and it seems to work pretty good. Unfortunately if you passphrase the key then you have to load the passphrase everytime you reboot. Does anyone know a way around this?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
then we are back to the same circumstnace where I am hardcoding a password/passphrase, which I am sure won't fly with the security team. If I used hte private/public key without a passphrase then anyone can grab the file and use it. just like a password.
Any other suggestions?
Any other suggestions?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
We ended up going with a priv/pub RSA key authentication which we opt not to password protect. This seems to do the trick and our information secuity office is ok with it
You can also try IIS7 if you have 2008...
http://learn.iis.net/page.aspx/304/using-ftp-over-ssl/
If you are looking for certificate logon for FTP then you might want to look for one that supports client certificate mapping.
The last concept you could look into is "SFTP" (FTP over SSH) - for this you can establish a secure shell and then use that for your FTP stuff. I haven't gotten aroudn to testing this out yet, but I understand not as many products support it but I believe PuTTY does which is a long established decent SSH program that is opensource /free that I would recommend anyways.