Secure file transfer

 

FTP traditionally been the most common method people use to upload files to a website. FTP stands for File Transfer Protocol. The problem with FTP is that passwords are passed to the server from your computer unencrypted, as clear text. What this means is that your password can be intercepted on the way to the server, and malicious people can use your password to retrieve your email, upload documents to your website, install software on the server, etc. For this reason, FTP access has been turned off on the L&S server and many other servers (such as the Physics server).

Options for secure file transfer

There are two general approaches to secure file transfer. One is to two use a secure file transfer method other than FTP such as secure copy (SCP) or SFTP (Secure FTP). The second option to use FTP through an SSH tunnel, which creates a secure pathway for the FTP password.

Dreamweaver

Dreamweaver MX 2004 and later versions have built-in support for SFTP.

There are instructions for setting up an SSH tunnel for Mac OS X for Dreamweaver MX (the version of Dreamweaver prior to MX 2004).

File transfer and other utilities

• HostExplorer for Windows includes a secure file transfer utility. It is free for campus users and can be downloaded from Software Central.
• Fetch, a popular file transfer utility for the Macintosh, now supports SFTP. Fetch is free for campus users and can be downloaded from Software Central.
• Fugu for Mac OS X is another free file transfer utility that can be downloaded from from Software Central.
• SSH Tunnel Manager is a free utility for Mac OS X that makes it easy to configure SSH tunnels.

Where to go for help

Configuring your computer to transfer files securely to a web server is not difficult, but it can be confusing if you have not done it before, so you should feel free to ask for assistance:

• If you are an LSCR supported customer, contact your LSCR support team (Tilden, Ohlone, or Faculty).
• If your site is on the L&S server, you can contact us directly for assistance at webmaster@LS.Berkeley.EDU or web@LS.Berkeley.EDU.
• If your site is not on the L&S server, you should contact the administrator of your server.