1
1
I have a problem and I am neither a system engineer nor an expert about certificates.
I have to transfer some file from a client to a SFTP server via SFTP protocol.
I have installed a SFTP server on my local Windows machine (I have used Cygwin). Everything works correctly. But I have a doubt, is the transfer on a secure channel? Or should I configure something on my server?
Should I have a certificate on my Windows machine that ensure me that the flow is encrypted? I think, the flow is encrypted because I am using SFTP. I think it's like HTTPS, i.e. encryption is implemented by protocol... So I don't have to do any particular customization to the server...
If I should generate a certificate (not for authentication), how can I do with Cygwin?
Do you mean that the flow is already encrypted? And do you mean that I just could change the way the flows is encrypted (rsa, des, ...) ? – Ciccio – 2014-11-06T14:28:47.070
yes, it is already encrypted with whatever cipher ssh traffic is encrypted with. yes, you can change the cipher (algorithm) of encryption. this is the same as ssh, again. – johnshen64 – 2014-11-06T14:30:50.587
So I don't have to look for any certificate installed on my machine. Right? – Ciccio – 2014-11-06T14:32:33.010
right, you don't have to. – johnshen64 – 2014-11-06T14:35:55.597
I have another doubt.. You talked about sshd_config... My sshd_config is the following:
# Ciphers and keying
#RekeyLimit default none
It looks like that it is not encrypted the flow now.. right? – Ciccio – 2014-11-06T14:55:43.443
The
RekeyLimit
defines how often should the client and server renegotiate the keys. Even if you have this feature turned off (what reduces security), the initial keys are still exchanged. Hence this setting does not turn off encryption. – Martin Prikryl – 2014-11-06T14:58:03.873But in the link @johnshen64 gave me, I read as follow:
Ciphers Specifies the ciphers allowed for protocol version 2. Multiple ciphers must be comma-separated. The supported ciphers are (a list of ciphers).. The default is: aes128-ctr, (another list)..
My default is different.. I do not have any.. – Ciccio – 2014-11-06T15:06:02.510
The
# Ciphers and keying
line is a comment/label (note the leading#
). It does not set anything. If you do not have theCiphers
option in the sshd_config, the default set of ciphers is used. – Martin Prikryl – 2014-11-06T15:09:07.520Ah ok, really Thank you... How can I see it by terminal? – Ciccio – 2014-11-06T15:12:15.003
If you have additional questions, please ask new question (after doing research). This is not a discussion forum. – Martin Prikryl – 2014-11-06T15:15:21.573