views:

420

answers:

6

I am still learning socket programming (using Perl) but I have both options ( socket programming and SSH/SCP/FTP) available to transfer the data from remote machines to my local servers.

But I have to select one which is more secure ( encrypted data on network) in terms of data transfer. Any suggestions.

+2  A: 

All network programming uses Sockets under the hood. So it's rather a matter of protocols you use.

Generally, if you want to be secure you should tunnel your communication using SSL (https, sftp, ftps)

Pawel Lesnikowski
+5  A: 

Just using sockets doesn't give you any security at all. The right choice depends on the application, the systems you're using, and how much the users understand about what they need to do to use it. For example, if you're interacting with a web server in a secure way, you'll probably end up using TLS/SSL for it. If you're just transferring data between two systems, using ssh might well be the most convenient way.

When you say "security", are you looking for encrypted data on the network? Authentication of the communicating parties? Both?

Another alternative is using TLS/SSL, probably with the OpenSSL toolkit (and there are Perl modules with bindings for it.) The programming is more complicated than with ssh, and you'll have to do more work on authentication for it, so it comes back to whatever it is you're trying to do.

Also, FTP isn't secure on its own either.

Win Treese
I mean encrypted data on the network.
Space
@Octopus There's no encryption of data using tcp/udp sockets directly (unless your hosts is also using e.g. IPSec or the data is tunelled over some encrypted channel).
nos
+1  A: 

SSH/SFTP/SCP all makes use of sockets under socket programming. Unless you have a better algorithm (for security) than what SSH provides, use a SSH module for Perl.

ghostdog74
+1  A: 

Out of the box sockets aren't secure. The data is transmitted in raw form from point A to point B.

Adding SSL adds security. Many protocols support SSL. In particular several flavors of FTP and HTTP support SSL.

FTPS is a widely supported on many platforms and by many clients. Even if you write a custom client, having other clients like FileZilla at hand for testing is nice.

If I were to start from scratch on such a system I would use FTPS.

csaam
+1  A: 

SSH is a remote shell protocol and itself it is not used for file transfer (like FTP). SCP file transfer protocol was part of SSH1 but as SSH1 is outdated and flawed, SCP is not recommended for use. In SSH2 (used in all modern systems) SFTP (SSH File Transfer Protocol) is used.

FTP (RFC 959) by itself doesn't provide any security. There exist extensions that let you run FTP over SSL/TLS (either implicitly, over pre-encrypted channel, or explicitly, via TLS as a part of FTP protocol). FTP over SSL is called FTPS (don't mix it with SFTP).

You can read detailed descriptions of pros and cons of FTPS and SFTP here.

Eugene Mayevski 'EldoS Corp
I don't know about your implementations, but my scp supports protocol version 2 and honors the default protocol version as selected by the server and/or .ssh_config. My sftp also supports protocol version 1. Neither is tied to a specific ssh protocol version.
Dave Sherohman
This means that your applications don't use SCP or SFTP as part of SSH protocol, but use SSH custom subsystem as a transparent transport for their data. While this can work in certain specific cases (i.e. on some unix systems), but this is NOT complicant to standards, and won't work in other environments. In other words, this is a specific case that you observe, not a rule.
Eugene Mayevski 'EldoS Corp
A: 

I would consider three main options:

  • FTPS (FTP over SSL/TLS) - it's equivalent of HTTPS which in simple terms means it's encrypted version of the ordinary FTP protocol. I think it's great for downloading over the Internet from remote and possibly public machines. It offers superior authentication mechanism in the form of X.509 certificates. There is some trouble with firewalls because it uses, as FTP does, two connections. If your goal is to prevent anyone from seeing what you're downloading this is IMHO perfect solution. I tend to use this protocol to access machines that I don't control.

  • SFTP (SSH FTP) - it's good protocol, maybe bit superior to the FTPS, but in my opinion it's better suited for controlled environment. I will use this protocol when I want to download a file from my account on one machine to another. Or when I want to upload new script to a server. It's for me remote equivalent of me going to the machine with flash drive and logging on the machine.

  • VPN - if those machines are fixed so to speak - you are always connecting to the same machines - I would consider using VPN to deliver the security. The transmissions are protected from outsiders, the server behaves like it's in the same network and I can use any protocol I want.

CodeRipper