Secure File Transfer

Contents

• Secure methods for transferring files to and from Athena
  • between Athena and other UNIX systems
  • between Athena and a Mac or PC
• Kerberized FTP
• SSH (Secure Shell), scp, and FTP

Tranferring files to and from Athena

If you are unable to use the methods below for any reason, your safest alternative is to change your password just before you do the file transfer, and change it back again as soon as possible. This will at least ensure that if your password is intercepted, it will be valid only for a brief period of time. Also see the guidelines on choosing a good password.

Secure file transfer between Athena and UNIX

Secure file transfer between Athena and a Mac or PC

SSH clients for Mac and PC do exist (see our SSH Overview for some links). They do not all provide scp, but some provide other means for making secure file transfers.

In the absence of kerberized FTP or SSH, Mac and PC users can securely copy files to and from Athena by performing the file transfer through kerberized telnet clients (NCSA telnet on the Mac, HostExplorer on the PC). Step-by-step procedures are given on the following pages from the CWIS group:

• Secure file transfer on the Mac
• Secure file transfer on the PC

• NCSA Telnet at MIT (for Mac)
• HostExplorer at MIT (for PC)

Kerberized FTP

Athena now supports kerberized ftp, but to connect securely from a non-Athena UNIX machine to an Athena dialup or private workstation, it is necessary to take the steps shown in example 1. (This is due to the fact that the existing ftp clients don't encrypt the connection automatically before asking for a password. Note that the Athena 8.2 ftp client has been specially modified to auto-encrypt, so that these steps should not be necessary if you were to ftp from Athena to a remote-access Athena workstation, or to another machine running a kerberized ftp daemon; see example 2.)

example 1: kerberized ftp to Athena

1. Use a kerberized ftp client. A krb4 version is available from the net-security kerberos installation kits, and a krb5 version is available in the krb5 locker. This example was taken from a krb5 ftp client; the krb4 one works similarly.
   
   
2. Connect to the dialup or other remote-access workstation:

         ftp ftp.dialup.mit.edu
   
         Connected to mass-toolpike.mit.edu.
         220 buzzword-bingo FTP server (Version 5.60) ready.
         334 Using authentication type GSSAPI; ADAT must follow
         GSSAPI accepted as authentication type
         GSSAPI error major: Miscellaneous failure
         GSSAPI error minor: Server not found in Kerberos database
         GSSAPI error: initializing context
         GSSAPI authentication succeeded
         Name (ftp.dialup.mit.edu:jqpublic): 
   

   You can safely ignore the GSSAPI errors as long as it says `authentication succeeded' at the end.
   
   
3. Enter your username but do not type your password. Leave the Password entry blank (just press the Return key):

         331 Password required for jqpublic.
         Password: [leave this blank!]
   

   It should respond:

         530 Login incorrect.
         Login failed.
         ftp>
         
   

4. Type `private' to encrypt the connection:

         ftp> private
         200 Protection level set to Private (Encrypted).
   
   

5. Now type `user' followed by your username to have it prompt you for your password again:

         ftp> user jqpublic
         331 Password required for jqpublic.
         Password: 
   

   and enter your password, which will now be encrypted.

         230 User jqpublic logged in.
         ftp>
   

   You can now continue with the standard ftp commands.

example 2: kerberized ftp from Athena

      athena% ftp private-machine.mit.edu
      Connected to private.machine.MIT.EDU.
      220 private-machine.mit.edu FTP server (Version 5.60) ready.
      334 Using authentication type GSSAPI; ADAT must follow
      GSSAPI accepted as authentication type
      GSSAPI authentication succeeded
      200 Protection level set to Private (Encrypted).
      Name (private-machine.mit.edu:jqpublic):

SSH (Secure Shell), scp, and FTP

scp example

      scp localfilename athena.dialup.mit.edu:/path/to/remotefilename

      scp athena.dialup.mit.edu:/path/to/remotefilename localfilename

      scp jqpublic@athena.dialup.mit.edu:/path/to/remotefilename localfilename

using SecureCRT for Windows file transfers

SecureCRT includes support for zmodem file transfer which can be used in conjunction with ssh for secure file transfer. In order to use this feature, you must add the sipb locker:

      add sipb

By default, SecureCRT will put files into the download directory within the SecureCRT install directory (and try to get files from the upload directory). To change this, go to the Options menu, select Session Preferences and modify the settings listed under the Files tab.

To send a file from Athena to your PC:

      sz -a filename       for ascii (text) files

      sz -b filename       for binary files

To send a file from your PC to Athena:

• From the Transfer menu, select Zmodem Upload List...
• Use the dialog box to select files to upload (the Add button puts the selected file on the list; use the Close button when the list is complete).
• From the Transfer menu, select Start Zmodem Upload.
• The following will appear in your terminal window; it applies to command-line use of zmodem's rz/sz command pair and should be ignored here. Once you see the athena% prompt, the file(s) should be in your current directory.

   athena% rz
   rz ready. To begin transfer, type "sz file ..." to your modem program
  
   athena%
  

securing the FTP channel (port forwarding)

1. Set up the port forwarding through ssh.
   
   For example:

          ssh -L 1234:ftp.dialup.mit.edu:21 ftp.dialup.mit.edu

   will log you in and forward connections made to port 1234 on your local machine to ftp.dialup (using the standard ftp port 21).
   
   
2. Use your FTP program to connect to the port you've just forwarded on your local machine.
   
   For example, in WS_FTP for Windows you should set up a Session Profile with:
   • Host Name: localhost
   • Advanced Profile Parameters (from the Session Profile screen, hit the Advanced button)
     • Remote Port: 1234
     • Passive transfers (use checkbox to make this active)

For general information on securing the FTP channel, see the SSH FAQ section on FTP or man pages.
For help with specific Mac/PC clients, see the F-Secure SSH FAQ or documentation from your SSH provider.
For more information on SSH see:

• SSH Overview (ACS Notes, pointers to download sites for all platforms)
• www.ssh.org (general SSH info., free UNIX versions)
• F-Secure SSH (commercial Mac and PC versions)

| Academic Computing | Contact us