Securely uploading files?

Discussion in 'Hosting Services / Control Panel' started by cwienands, May 30, 2007.

Thread Status:
Threads that have been inactive for 5 years or longer are closed to further replies. Please start a new thread.
  1. Hello all,

    I'm currently wondering whether there is a more secure way to upload files than through FTP. I went through a number of older posts and from what it seems, WebDAV is not supported by DASP because of other security holes than just sending unencrypted passwords. I also read that the only secure way to upload my website files and so on is through FrontPage Extensions.

    Now, on the DASP admin interface it says:
    IMPORTANT: FrontPage Extension manipulates NTFS permissions. If you do not use FrontPage or Visual Studio to publish your site, then do not install FrontPage Extensions, as it can render your site nonfunctional.

    Ideally I don't want to use VS to publish my files but map a network drive. I have a tool called WebDrive that supposedly supports the "FrontPage" protocol to map network drives. Before I activate FP Extensions and test it, what are the side effects of installing it on the server? What NTFS permissions does it change? How would I know that my site is nonfunctional and could I potentially fix it while having FP Extensions enabled? Am I opening any other security holes?

    Thanks a lot,

    Christoph
     
  2. Bruce

    Bruce DiscountASP.NET Staff

    There are several common problem associated with the extension


    1) FPSE will sometimes turn off execute/script IIS permission after you upload. This is a known bug that we discovered with MSFT about 12 months back.


    2) FPSE will sometime change the NTFS permission on the folder. It will sometimes disablepermission inheritence, at other time, it will change object permission to read only.


    In addition, if you use FP to upload, you'll still need to use HTTPS to ensure encrypted transfer.


    Bruce

    DiscountASP.NET
    www.DiscountASP.NET
     
  3. Hello Bruce,


    thanks for the info. I'll give FPE a shot since I have HTTPSenabled/required already.


    Christoph
     
Thread Status:
Threads that have been inactive for 5 years or longer are closed to further replies. Please start a new thread.

Share This Page