me == >
I am unable to connect to sftp on port 22
---------------------------------------
Hello,
Unfortunately sftp is not available to use on our servers.
If there is any further information you require, please contact us and we will be pleased to help you.
Best Regards,
Travis
---------------------------------------
me ==>
is there any chance of obtaining sftp.
Without sftp there are numerous security problems that could arise regarding packet sniffing as well as unknown interference. If I need secure transfer how am I supposed to do so?
-----------------------
me ===>
Hello,
Unfortunately SFTP is disabled and cannot be enabled because of server security reasons so I'm afraid that we cannot provide you wit this server.
However, if there's anything else we can do for you, do not hesitate to ask.
Best Regards,
Boby
-------------------------
me===>
I hope you understand then that you have a major security risk right now. You have FTP enabled.
SFTP, or secure FTP, is a program that uses SSH to transfer files. Unlike standard FTP, it encrypts both commands and data, preventing passwords and sensitive information from being transmitted in the clear over the network.
Furthermore for uploads, the transferred files may be associated with their basic attributes, such as timestamps. This is an advantage over the common FTP protocol, which does not have provision for uploads to include the original date/timestamp attribute.
FTP on the other hand is insecure and allows packet sniffers to see any users passwords - including root if root logs on; and had problem after problem. Anyone minimally concerned about security has this feature enabled.
Do you have SSH enabled or is it not as secure as telnet? At a minimum do you offer SCP?
-----------------------------
Hello,
I asked our system administrators about enabling SCPY and SFTP (yes, I am fully aware of the benefits of using them) but they informed me that the can't be enabled.
Best Regards,
Boby
-----------------------------
me==>
why not?
I can only assume that security is not a top concern of yours?
------------------------------
Hello,
I'm afraid that our administrators informed me that it's clear that this matter will not be the subject of a discussion.
I know that you must be disappointed - so am I :( but i asked them about this several times and I couldn't get a positive reply or more details for their decision.
Best Regards,
Boby
-------------
me==>
I have some experience in web server administration. I will understand if you can explain to me why you can not enable a basic security feature.
If you are unable to provide an explication I must assume that 506host does not care about consumer security and I will ensure those in the proper circles know about this.
As part of any basic security encryption through insecure pipes must be required. I have credit card numbers and personal information on this account and I require a secure method of transport.
If possible can ANY of the following secure protocols be enabled?
FISH
Odette File Transfer Protocol
FTPS
FTP over SSH
------------------------------------
Hello,
Our system is custom-build so a lot of not-so-standard changes in the overall architecture have been made so enabling the use of the features you requested will require a sufficient amount of changes which will take the of course time for testing and debugging and I'm afraid that the admins are not up to the task of making such remodeling since there haven't been cases of FTP sniffing and exploits.
On the other hand there are so many new projects that I can understand why the admins are not up to the task of enabling a feature which only a handful of advanced individuals will take advantage of. But that won't change the fact that this sucks :(.
If you wish to have these secure services then I can suggest you visit out affiliates at http://www.resellerspanel.com/?a=clchinchilla and take a look at the dedicated servers and VPS solutions there. Since such a machine will be install from ground 0, you can request what additional features are to be installed and you will have better control over your resources - after all you will have a root account in either case (the dedicated server or the VPS).
Best Regards,
Boby
----------------------
me==>
Any script kiddy with a mouse and a computer can use this attack. The ONLY solution is SFTP.
When dealing with sensitive data you don't take any chances.
-----------
Hello,
Thank you for the information - I'll see to it that this ticket gets to a supervisor so that he can consider this with our managers and we'll see what will come of it.
This is the best I can do for you right now.
Best Regards,
Boby
----------
me==>
if you are even minimally concerned about security I would recommend that SFTP be enabled. I question if I could trust that my customer's orders are safe on this web host.
Also those "special builds" are BS. if you enabled SSH you could just as easily enable SFTP.
---------------------
Hello,
We have received a reply from our admins that unfortunately these protocols cannot be installed on the server and they were not so far as were not popular among the clients.
Also as this is a shared hosting server , we are unable to install them additionally upon single request. We understand the features they provide and how important is this for you but I am afraid that we cannot help here , also if it was so easy we would have them installed already.
Thank you for your time and understanding regarding this matter.
Best Regards,
Pete