Directory and File transfer Services By Jothi

Two key resources Lightweight Directory Access Protocol (LDAP) File Transfer protocol Secure file transfer protocol (S/FTP)

LDAP Protocol for accessing directory services over a network Deployed on top of TCP, with underlying database can be of any variety

Common applications of LDAP Single Sign-on (SSO) User Administration Public key infrastructure

LDAP Operations Open Bind Search Modify Add delete

LDAP Security Benefits Authentication Authorization Encryption

LDAP Security Vulnerabilities Denial of service Man in the middle Attacks against data confidentiality

FTP A protocol which allows users on computer to transfer files to another computer One of the most commonly used application protocols on internet

Transmission Methods Active FTP Passive FTP Note : Depends on server’s Role.

Differentiate Active & passive Active FTP : command : client >1024 -> server 21 data : client >1024 <- server 20 Passive FTP : command : client >1024 -> server 21 data : client >1024 -> server >1024

Why FTP and not http Allows transfer in ASCII or in binary form Fast and reliable. (compared to http)

FTP’s Connections User Interface User Data Transfer Function User Protocol Interpreter Server Protocol Interpreter Server Data Transfer Function client server Control Connection Data Connection 2 ftp> ttu.edu Connected to ren 220 ren FTP server ready. Name (ren:Jothi): USER Jothi Server Protocol Interpreter User Protocol Interpreter 331 Password req for jothi. Password:whatever PASS whatever 230 User Jothi logged in. ftp> ls myProg.c Bind to Port PORT 192,168,0,2,227, PORT command successful. LIST myProg.c Connect to client PORT Server Data Transfer Function User Data Transfer Function 150 Opening ASCII mode data connection for /bin/ls. Terminate Connection User Data Transfer Function 226 Transfer complete -rwxr-xr-x Jothi myProg.c Server Data Transfer Function

FTP Security Issues Bounce Attack Clear text Authentication and data transmission Glob Software exploits and buffer over flow Anonymous FTP and Blind FTP access

Secure File Transfers Sftp is a secure version of the File Transfer Protocol (ftp). SFtp uses FTP commands to transfer files securely between accounts

Why SFtp ? File Transfer Protocol (FTP) doesn't provide for encrypted data transfer, which means that using FTP can expose not only data but also passwords and filenames. Increasingly, large data centers and computing facilities are prohibiting FTP transfers of sensitive data over unprotected networks. Secure File Transfer is the solution for the safe transfer of data needed to address required levels of authentication including digital certificates

SFtp implementations SSH PuTTY

References “Windows Internet Security” by Seth Fogie, Cyrus Peikari “Big book of LDAP” by Pete Loshin