How to configure an FTP server with SSL

BROWSE BY TAG Application Security,   SSL and TLS VPN Security,   Secure VPN Setup and Configuration,   Enterprise Network Security,   Application and Platform Security,   Email Protection,   Email Security Guidelines, Encryption and Appliances,   VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Application Security Do Facebook URL security concerns justify blocking social networks? Is there a way to block iPhone widgets that bypass Web filters? Should enterprises be concerned with Twitter in the workplace? Are there still Google Desktop security problems? Can an IP spoofing tool be used to spam SPF servers? Will an application usage policy best control network bandwidth? How can URL-shortening services be manipulated? Is my security program ready for Web application firewall deployment? How to ensure the security of a shopping cart application When to use the service features of the Metasploit hacking tool SSL and TLS VPN Security Expert calls SSL protocol vulnerability a non issue How SSL-encrypted Web connections are intercepted Best Remote Access Products How to set up a split-tunnel VPN in Windows Vista Securing the intranet with remote access VPN security A short enterprise VPN deployment guide Creating an SSL connection between servers Can S/MIME, XML and IPsec operate in one protocol layer? Can secure USB devices prevent man-in-the middle attacks How to secure SSL following new man-in-the-middle SSL attacks Email Security Guidelines, Encryption and Appliances How to confirm the receipt of an email with security protocols Best Email Security Products Can an IP spoofing tool be used to spam SPF servers? WatchGuard acquires email and Web security vendor BorderWare McAfee to acquire email SaaS vendor MX Logic What does 'invoked by uid 78' mean? How to configure firewall ports for webmail system implementation Fierce competition prompted new Cisco email security options Cisco brings email security appliances closer to SaaS Cisco offers more email security choices, but lacks vision

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary Secure Shell  (SearchSecurity.com) Secure Sockets Layer  (SearchSecurity.com) server accelerator card  (SearchSecurity.com) SSL VPN  (SearchSecurity.com) Transport Layer Security  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

Yes it is. The iSeries FTP server supports either Transport Layer Security (TLS) or Secure Sockets Layer (SSL) protected sessions, including client authentication and automatic sign-on to encrypt data transferred over both the FTP control and data connections. Before you can configure your FTP server to use SSL, you must install the prerequisite programs and set up digital certificates on your iSeries server. However, before we look at how to configure your FTP server it is important to understand the FTP protocol.

FTP uses two TCP connections, one for control and one for data. The standard control connection is TCP port 21, and the default data connection is port 20. To start a secure FTP (FTPS) session, a client can connect to the non-encrypted TCP port 21 and then negotiate authentication and encryption options. This is known as an explicit control connection. On the other hand, an implicit connection is when the client chooses a secure FTP port; usually port 990, where connections are assumed to be TLS/SSL. The primary reason to encrypt on the control connection is to conceal the password when logging on to the FTP server. FTP does not allow you to have a secure data connection without a secure control connection.

When you use TLS/SSL encryption for the control connection, the FTP client will also encrypt the data sent on the FTP data connection. Encryption can have a significant performance cost and can be bypassed on the data connection to transfer non-sensitive files without decreasing performance and still protect the system's security by not exposing passwords. The iSeries FTP server provides for both of these options. In order to set up FTP with SSL on your iSeries V5R2 server you will need to ensure that it has the following installed:

• V5R2 or later of OS/400


• TCP/IP Connectivity Utilities


• Cryptographic Access Provider 128-bit for iSeries server


• IBMR Digital Certificate Manager (DCM)


• IBM HTTP Server

1. Create a Local Certificate Authority or use DCM to configure the FTP server to use a public certificate associate with the FTP server


2. Require client authentication for the FTP server


3. Enable SSL on the FTP server