Can FTP use SSL or IPSEC?

RZetlin

I am stuck on this pratice question:

John is the security officer for her company. His greatest concern is that someone could intercept communications between the users and the company servers. He breathed a sigh of relief when he remembered that the internal web servers used SSL as the security protocol. Then he turned his attention to file transfers made through FTP. How can he secure this kind of traffic?

My choices are:

a. SSL for FTP
b. use Public/Private Key exchange
c. IPSEC
d. use the encrypted file system (EFS)


My first choice is IPSEC since IPSEC works on Layer 3 and up.

Though the web servers use SSL which points to SSL or certificates.

blargoe

I would think IPSEC, that could secure FTP and any other communication between two hosts.

I don't think SSL/certificate based FTP exists, though there is something called "Secure FTP" that is simply a way to transfer files using SSH. You won't see that on a MS exam though.

RZetlin

SSL with FTP would work, but since the whole subject for 70-291 is on IPSEC that seems to be the correct choice.

TeKniques

It's C for sure.

I secure FTP with IPSec where I work because IIS has no SFTP features. Hopefully IIS 7 will include that and make things a lot easier.

Slowhand

Yup, it's definately IPSec, since it's pretty indiscriminant about what it's securing, as long as it's IP traffic.

RTmarc

communications between the users and the company servers

IPSEC all the way.