So clearly it would be good to find an alternative means of accessing the server. And once they know them, they can access your FTP server. Anyone who handles the postcard on its way to the bank can read your private access details. It's like writing a postcard to your bank with your account number and password on it. Unbelievable, right? But it's true, your valuable authentication information is broadcast across the internet in plain sight. And then the client has to send this information back to the server, in plain text. When you access an FTP server, it asks for your username and password. The problem is that the FTP mechanism for authentication is rubbish. But there's one problem, in particular a problem with the authentication, for all of these clients. Some have more features than others, some are easier to use or more mature, you can even just ftp from the command line if you like. So far so good, and you can get any of the many GUI FTP clients out there to access your site. For any system which restricts access, you need a valid username and a valid password to get in. If anonymous access is allowed then you just need to enter ' anonymous' as your username and anything you like as a password, and that's fine. There are two options for permissions when it comes to uploading - either the FTP server is set up to allow anonymous uploads, or it requires a username and password in order to authenticate. The main difference with HTTP comes when you're uploading files instead of downloading them. Many regular web browsers can handle FTP downloads as well, but there are of course many dedicated FTP clients, too numerous to list here. For the downloading it works in a similar way to the familiar HTTP protocol, except that the request is answered by an FTP server instead of a HTTP server. FTPįTP, or 'File Transfer Protocol' (see wikipedia) is a popular mechanism for downloading and especially uploading files.

This section deals with finding a secure alternative to FTP and using Wireshark to check that it really is secure.

Wireshark packet capture on test ftp