Topic: General Apache Question(win XP sp2)

[i throw kids at rocks]

I have a question. For 'secure file transfer' do you prefer ssh or apache via wget? Which one is more secure for file transfer? If you ask me, I would say Apache via wget because I don't have to disable any firewalls and that's a good thing right? But for SSH I do have to disable all firewalls just to transfer files, which is not acceptable to me.

If you are curious to know what I'm transfering, well nothing valuable really it's just nothing but movie files and song files. I just want to know which ones you guys prefer(ssh or apache+wget)? Thank you.

[James Blond]

Do you mean wget form Linux / Unix?

[i throw kids at rocks]

I mean wget for windows. Here is the link:

http://gnuwin32.sourceforge.net/packages/wget.htm

[James Blond]

Ok, that is simular to the Linux wget. wget is not safe, because there is no encryption.
For secure file transfer you should use a ftps server.

Also webdav over https would be secure.

I have no experience how to send files over ssh.

[Brian]

I use SSH on Windows, I have reasonably little experience with Linux, other than I have installed it, and have recently messed around with in a VMWare environment.

It seems to me that if a port is open and nothing is listening, there is no security risk, right? Correct me if I am wrong but a port has to be monitored by some process or it would be no different than talking to one's own self.

Next, if you place a server on a specific port, and it is secure, then you should be able to assume that just by opening a port through your firewall that you are not necessarily creating a significant security hole. That being said, if you allow any ports to be open through your firewall, you are at least theoretically creating a security hole, right?

I almost contradict myself in the preceding paragraph, but then I think that there is an inherent contradiction in the balance that must be struck between usability and security.

I guess it is six of one and half dozen of the other as to which encrypted means you choose. I would opt for SSH over other methods of secure data transfers simply because of the proven success and history of SSH on Linux and Unix platforms.

I take my remote server management to a new level of security by forcing the RDP client to connect via a RSA's RC4 encryption by policies set on the server, and then I tunnel my already encrypted RDP sessions through an SSH connection. If you want to be really crazy then you could require both a password and a key, place that key on a thumb drive and then you have two distinct forms of security:

1) what you know (your password)
2) what you have (your key)

Oh, and you could ad a biometric device to your workstation providing yet another form of security, what you are.

Ooooops, off topic a bit...

So I guess the whole point is that you want the packets to get from point A to point B without being viewed, or if they are at least making sure that the data is not discernable by anyone who may intercept them, right?

How likely is it that anyone is packet sniffing the node you are on or the node you are connecting to?