2

We have a client facing web site. A certificate is required to land on the login page, where upon you then need a username and a password to further login. System has Apache servers acting as load balancers up front, and then Tomcat servers serving the application. All OK so far, but we now want to provide file upload ability for users to bulk upload configuration changes to settings within the application.

Any thoughts on best approach? Is it possible to establish a true SFTP connection over the already established and authenticated HTTPS link somehow? If not, how? Thoughts?

TildalWave
  • 10,801
  • 11
  • 45
  • 84
ninky-nonk
  • 21
  • 1
  • 1
  • 2

3 Answers3

2

Is it possible to establish a true SFTP connection over the already established and authenticated https link somehow?

Yes, if you rewrite the HTTPS implementation in the server and client, and write a custom SFTP client, and solve the problem of sharing a socket across different processes....

Why don't you just use HTTP (over SSL) to upload the file?

symcbean
  • 18,278
  • 39
  • 73
1

SFTP is another protocol. SFTP is built over SSH (precisely, over the transport protocol used also by SSH). You might think about FTPS, which is FTP-with-SSL. However, there is no easy (or even hard) way to mix HTTP and FTP traffic over the same SSL session.

If you went to the trouble of establishing a secure, authenticated HTTPS session, then my advice would be to use it, and provide a Web-based upload system. Uploading single files is easy enough. For bulk uploads, you will want a richer user interface (to select many files, upload directories recursively,...) and, for that, you will need some code on the client side (not Javascript, though, but code which has full access to the local files). It is kind of tricky to reuse an existing Web session (for instance, if the local code is a signed Java applet, then that applet must hand over the file contents to some Javascript code, which will then do the upload through the browser). Some basic Googling points to CuteUpload, which is an ActiveX control (thus limited to Windows+IE). Alternatively, distribute to your users some application (which can be a signed Java applet) which will open the connection to the server and do the authentication itself (instead of using the browser), at which point you do what you want. Whether this is applicable to you really depends on your exact context.

Tom Leek
  • 168,808
  • 28
  • 337
  • 475
0

If you already have a certificate-base client authentication system, you already have a secure channel. Adding SFTP to that mix wouldn't improve security but it would increase complexity and expand your attack surface.

I do have one question, though: why do you require a username and password after requiring a certificate-based logon ?

Stephane
  • 18,557
  • 3
  • 61
  • 70
  • HTTPS secures client to server traffic, but does nothing to ensure that a client or user of the client has *permission* to send the traffic. An authentication mechanism, protected from MITM attack due to HTTPS offers that. Though if the user uses browser caching of user/password details and does not lock their PC, the cleaner (janitor) could have a field day... – Nick Jul 05 '13 at 19:38
  • From what I read of the OP, he's already using client certificate authentication ("A certificate is required to land on the login page") which means that authorization has already been checked and in a much better way than username/password. – Stephane Jul 08 '13 at 09:45