Securing files over ftp transfer

[tizwoz]

After my external encrypted hdd failed on me the other day (cheap external case, I guess you get what you pay for!! ) a friend has set up another hdd in this server (running windows 2003 sadly) and has designated that for my backups.

I'll simply access this folder via ftp using rsync and make my backups as normal, only it'll be over the net...

However, being the paranoid penguin I am, I'm really worried how secure this will be. Could my files be intercepted whilst I'm transferring?

I've looked into encrypting them with gnupg, it's a neat bit of kit, but it only does single files at a time. I want want a whole folder encrypting (and it's sub folders). I've yet to find anything to do this.

Any suggestions? Do I need to worry about encrypting them even?

[ms1234]

Yes.

Try out scp or sftp or if you're using KDE the fish protocol.

[tizwoz]

Originally Posted by ms1234

Yes.

Try out scp or sftp or if you're using KDE the fish protocol.

Didn't find that but I did a yumex search for "scp" which returned a program that looks to the job that I want!!

http://duplicity.nongnu.org/index.html

"Duplicity backs directories by producing encrypted tar-format* volumes and uploading them to a remote or local file server. Because duplicity uses librsync, the incremental archives are space efficient and only record the parts of files that have changed since the last backup. Because duplicity uses GnuPG to encrypt and/or sign these archives, they will be safe from spying and/or modification by the server."

*Exactly what I want!! Works like rsync which is great too. Just installed it via yumex, gonna play with it now

[tizwoz]

Hmmmmmmmmm. Followed the man page, but hitting errors, google's not picking anything up either any ideas?

------------------------------------------------------------------------------------
FTP_PASSWORD=myftppw duplicity /home/tizwoz/test1 ftp://tiz@##.##.##.##/tiz
GnuPG passphrase:
Retype to confirm:
No signatures found, switching to full backup.
Traceback (most recent call last):
File "/usr/bin/duplicity", line 373, in ?
if __name__ == "__main__": main()
File "/usr/bin/duplicity", line 366, in main
if not sig_chain: full_backup(col_stats)
File "/usr/bin/duplicity", line 142, in full_backup
bytes_written = write_multivol("full", tarblock_iter, globals.backend)
File "/usr/bin/duplicity", line 89, in write_multivol
backend.put(tdp, dest_filename)
File "/usr/lib/python2.4/site-packages/duplicity/backends.py", line 349, in put
self.error_wrap('storbinary', "STOR "+remote_filename, source_file)
File "/usr/lib/python2.4/site-packages/duplicity/backends.py", line 335, in error_wrap
except ftplib.all_errors, e: raise BackendException(e)
duplicity.backends.BackendException: 550 Cannot STOR. No permission.
---------------------------------------------------------------------------------------------

Tried that as user & root

[tizwoz]

WaaaaaaaaaaaaahoooooooooooooooooooooooooooooooooO! !!

Got it working. Not sure exactly what it was, but I did a local test, then tried ftp (didn't work) then tried another ftp server, worked fine, so it was a problem with the naming of files.


Soooo happy!!! This is like well cool and my docs are safe from peeping toms (well numpty peeping toms )


Waahooo!

No need to comment, yes I already know I'm a sad geek

Many thanks to ms1234 i'd never have found out about this otherwise

[tizwoz]

Right, as mentioned I did get this working, but ever since I tried ftp'ing to a ftp account on a windows 2003 server machine, i've hit loads of problems (I've even gone so far as mounting the ftp folder to try and get it working, but to no success).

After a lot of buggering about I've drilled it down to the filename / file. When I run this script accessing my webhosts ftp space, it works fine - no problem.

So I did this...

I got an encrypted file (previously encrypting by running duplicity locally) - filename:duplicity-full.2006-11-16T14:17:22+01:00.manifest.gpg and tried to transfer it manually via fireftp in firefox.

I got back: 550 Cannot STOR. No permission. any other file I can tranfer, just not these encrypted files.

Any suggestions why? I can do it to my webspace, just not his server. Maybe there's a setting my friend has to tweak on his end? Maybe the length of the filename is the problem? (ie. the length).

[tizwoz]

Just to try and eliminate things further (wasn't sure if it just wasn't accepting any files ending in ".gpg") so I renamed an really long file (the one above) to encrypted.gpg and tried transferring again, it did it fine, np whatsoever.

So it must be the length of the filename. I suppose this problem doesn't know fall into the critera of Fedora as it's a problem the way his ftp is set up on the other end? Goes googling If anybody does know the setting etc off the top of their head and beats me back here, I'd appreciate to know

All I know is he's running windows 2003 server, running his ftp server off that.

[keithwright]

Originally Posted by tizwoz

After my external encrypted hdd failed on me the other day (cheap external case, I guess you get what you pay for!! ) a friend has set up another hdd in this server (running windows 2003 sadly) and has designated that for my backups.

I'll simply access this folder via ftp using rsync and make my backups as normal, only it'll be over the net...

However, being the paranoid penguin I am, I'm really worried how secure this will be. Could my files be intercepted whilst I'm transferring?

I've looked into encrypting them with gnupg, it's a neat bit of kit, but it only does single files at a time. I want want a whole folder encrypting (and it's sub folders). I've yet to find anything to do this.

Any suggestions? Do I need to worry about encrypting them even?

Can you install OpenSSH on the Windows server and then use secure copy (scp) between the two?

[wsmith2002]

Never use ASCII mode to ftp a PGP/GPG file. Always use binary. Windows loves to use ASCII as default, but it will make a mess of PGP/GPG files. Every now and then it will "See" a combination of characters as a control chacter and make a change to the file. Change one bit in the file and it will not open. I haven't found a good reason to use ASCII FTP for anything. Also if you need a bunch of files moved, try making a tar file out of them, then either gzip or GPG. Both PGP and GPG do file compression as part of the process. Using sftp, scp or something similar (open ssl) will give you 128 bin encyrpiton. With PGP/GPG you can get up to 4096 bit encryption. Probably don't need to go over 1024.