Windows 2012 and 2008 IIS - need secure FTP

I have read that Windows 2012 and 2008 IIS do not natively support SFTP. They support FTPS or FTP over. What would be the best options for securing FTP file transfers? Maybe using HTTPS?

DLH
DLH DLHAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

William MillerIT SpecialistCommented:
FTPS secures via SSL, which can be very similar in terms of security. The primary difference between the two (functionality aside) is that with SSL (or FTPS in your case) you would need a digital certificate as part of the authorization. This normally requires a Certificate Authority to accomplish. You can use a self-signed Certificate as well, but that's really only useful for inter-office transfers.

Here is a great article for configuring FTPS on Windows Server:

https://social.technet.microsoft.com/wiki/contents/articles/39941.how-to-configure-ftps-with-public-certificate-in-iis.aspx

If you don't want to use FTPS, then you could turn to a third party SFTP software such as OpenSSH. A guide on doing this can be located here:

https://winscp.net/eng/docs/guide_windows_openssh_server

If you want to stick to standard FTP, then you're potentially leaving yourself vulnerable. Network-related threats are a real issue in today's age and FTP increases your Attack Surface (Basically this is the sum of potential points of vulnerability within your network).
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
Just one thing to add to the previous expert.  I've had good luck in the past using Bitvise for SFTP.  It's just one more option in the third party SFTP realm.  Patches have been timely (especially security patches), configuration in the current version is fairly easy, and it can use active directory users easily enough.

The big thing to be aware of, however, is that users will need to use a SFTP client, which is certainly not as ubiquitous as http/https/ftp clients.  Which solution you use to transfer the files may well be greatly influence by that consideration.  (And on that note, WinSCP (William Miller already linked above) has a good client side SFTP client.)
0
DLH DLHAuthor Commented:
Thank You both. Sounds like similar information I had been reading. it always helps to get answers from experts so I can assist in formulating a solution.

DLH
0
William MillerIT SpecialistCommented:
No problem at all! Glad to be of help.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking Protocols

From novice to tech pro — start learning today.