1. Directory and File transfer Services By Jothi

2. Two key resources Lightweight Directory Access Protocol (LDAP) File Transfer protocol Secure file transfer protocol (S/FTP)

3. LDAP Protocol for accessing directory services over a network Deployed on top of TCP, with underlying database can be of any variety

4. Common applications of LDAP Single Sign-on (SSO) User Administration Public key infrastructure

5. LDAP Operations Open Bind Search Modify Add delete

6. LDAP Security Benefits Authentication Authorization Encryption

7. LDAP Security Vulnerabilities Denial of service Man in the middle Attacks against data confidentiality

8. FTP A protocol which allows users on computer to transfer files to another computer One of the most commonly used application protocols on internet

9. Transmission Methods Active FTP Passive FTP Note : Depends on server’s Role.

10. Differentiate Active & passive Active FTP : command : client >1024 -> server 21 data : client >1024 <- server 20 Passive FTP : command : client >1024 -> server 21 data : client >1024 -> server >1024

11. Why FTP and not http Allows transfer in ASCII or in binary form Fast and reliable. (compared to http)

12. FTP’s Connections User Interface User Data Transfer Function User Protocol Interpreter Server Protocol Interpreter Server Data Transfer Function client server Control Connection Data Connection 2 ftp> ttu.edu Connected to ren 220 ren FTP server ready. Name (ren:Jothi): USER Jothi Server Protocol Interpreter User Protocol Interpreter 331 Password req for jothi. Password:whatever PASS whatever 230 User Jothi logged in. ftp> ls myProg.c Bind to Port 58311 PORT 192,168,0,2,227,199 200 PORT command successful. LIST myProg.c Connect to client PORT Server Data Transfer Function User Data Transfer Function 150 Opening ASCII mode data connection for /bin/ls. Terminate Connection User Data Transfer Function 226 Transfer complete -rwxr-xr-x Jothi myProg.c Server Data Transfer Function

13. FTP Security Issues Bounce Attack Clear text Authentication and data transmission Glob Software exploits and buffer over flow Anonymous FTP and Blind FTP access

14. Secure File Transfers Sftp is a secure version of the File Transfer Protocol (ftp). SFtp uses FTP commands to transfer files securely between accounts

15. Why SFtp ? File Transfer Protocol (FTP) doesn't provide for encrypted data transfer, which means that using FTP can expose not only data but also passwords and filenames. Increasingly, large data centers and computing facilities are prohibiting FTP transfers of sensitive data over unprotected networks. Secure File Transfer is the solution for the safe transfer of data needed to address required levels of authentication including digital certificates

16. SFtp implementations SSH PuTTY

17. References “Windows Internet Security” by Seth Fogie, Cyrus Peikari “Big book of LDAP” by Pete Loshin http://www.gracion.com/server/whatldap.html http://slacksite.com/other/ftp.html http://www.alphaeducation.com/techdoc/ftp.pdf http://csrc.nist.gov/publications/nistpubs/800-7/node122.html