SFTP Port Alternatives for Remote Access File Share Remote Access

SFTP, which is often mistaken as an abbreviation for “Secure File Transfer Protocol,” truly represents SSH File Transfer Protocol. SFTP was developed in in the early days of the internet and is detailed in this SFTP RFC Specification.

The SFTP protocol was known originally as simple FTP (File Transfer Protocol). The FTP protocol supports file transfer over TCP port 21 with TCP port 22 used for SFTP and port 990 used for TLS/SSL Implicit encryption.

SFTP is a basic file transfer protocol and although it can be quite fast due to its simplicity, additional features such a file sharing, collaboration, authentication, and single sign-on are not defined for the protocol.

Over time the FTP Protocol has been updated to add encryption (SFTP), support TLS/SSL encryption and improve firewall/security issues – for example RFC 1579 (February 1994) enables Firewall-Friendly FTP (passive mode), RFC 2228 (June 1997) proposes security extensions, RFC 2428 (September 1998) adds support for IPv6 and defines a new type of passive mode.[8].

SFTP

Introduction

Secure File Transfer Protocol (SFTP) is a network protocol that enables secure and encrypted file transfers between a client and a server. It is designed to provide a secure alternative to traditional File Transfer Protocol (FTP) by incorporating Secure Shell (SSH) for authentication and data encryption.

In this article, we will delve into the world of SFTP, exploring its basics, port management, server configuration, and more.

Understanding the secure file transfer protocol is crucial for ensuring the safety and integrity of your data during file transfers. Whether you’re dealing with sensitive information or simply need a reliable method for transferring files, SFTP offers a robust solution that leverages the power of secure shell to protect your data.

Understanding SFTP

SFTP is an extension of Secure Shell (SSH) and was introduced in SSH v2 or SSH-2. It is a method for transferring files over SSH, and every SSH server is technically an SFTP server as well.

SFTP uses the same port number as SSH, which is 22 by default. This makes it a popular alternative to the standard File Transfer Protocol (FTP) due to its enhanced security features. These features include public key cryptography, which enables data-in-motion encryption, authentication, digital signing, and data integrity mechanisms.

By using an SFTP server, organizations can ensure that their file transfers are secure and that their data remains protected from unauthorized access. The integration of secure shell into the file transfer process adds an extra layer of security, making SFTP a preferred choice for secure file transfers.

SFTP NAT and firewall traversal issues

Typically, internet service providers block SFTP Ports to prevent issues with security and malware by preventing file access over SFTP ports. SFTP Requires ports 22 or 990 to be open, which is prone to malware including the likes of infamous offenders like Wannacry, Sasser, Nimda, Petya/NotPetya, and more.

If STFP Ports are open, an infected computer will search its Windows network for Server shares accepting traffic on TCP ports 22 or 990 indicating the system is configured to run SFTP. While modern Web Application Firewalls (WAFS) can be tuned to monitor HTTP traffic, SFTP traffic is not as easily monitored.

SFTP transfers data by responding from the server to the client after a PORT command has been sent. This is a problem for firewalls which do not allow connections from the internet inbound toward internal hosts. This is a particular issue with Microsoft IIS which responds with a random port.

The two approaches to solve this issue are to either set the SFTP server to use the PASV command or to use an application level gateway to alternate the port values.

SFTP Port Management

SFTP uses TCP port 22 as its default port number. However, it is possible to assign a different port number for the SFTP service. Changing the default SFTP port number can be done for security reasons or to reduce the complexity of network maintenance. For instance, using a non-standard port can help obscure the service from potential attackers who scan for default ports.

However, it is essential to note that changing the port number requires updating firewalls, clients, and servers, which can add complexity to network maintenance. Proper port management is crucial for maintaining the security and efficiency of your SFTP connections.

By carefully selecting and managing port numbers, organizations can enhance their security posture while ensuring smooth and reliable file transfers.

SFTP Server Configuration

Configuring an SFTP server involves several steps, including setting up the SSH server configuration file, sshd_config. This file contains settings for the SSH server, including the port number, authentication methods, and encryption algorithms.

To change the SFTP port in Windows, the sshd_config file needs to be modified, and the SSH service needs to be restarted. In Linux, the sshd_config file also needs to be modified, and the SSH service needs to be restarted. Proper configuration of the SFTP server is essential for ensuring secure and efficient file transfers.

By carefully setting up the SSH server configuration file, organizations can customize their SFTP server to meet their specific security and operational requirements.

This includes selecting the appropriate port number, enabling strong authentication methods, and choosing robust encryption algorithms to protect data during transfer.

SFTP Default Port Remote Access

To facilitate remote access to files, businesses have often granted users access using SFTP servers. This provides some level of remote access, however the support costs of training users and deploying SFTP client software is extensive.

In addition, SFTP is not easily integrated into existing file servers and Active Directory to present a unified file sharing experience.

When accessing files remotely user expect to easily access their existing home drives and department shares over a standard mapped drive that fully support file locking, Office, and other applications. STFP was never designed for file sharing or collaboration.

SFTP Port vs HTTP/s

HTTP port 443 is an updated protocol that essentially fixes the bugs in SFTP that made it inconvenient to use for many small transfers.

SFTP uses a stateful control connection which maintains a current working directory and each transfer requires a secondary connection through which the actual data is transferred.

In “passive” mode this additional connection is from client to server, whereas in the default “active” mode this connection is from server to client. This SFTP port change when in active mode, and random port numbers for all transfers, is why firewalls and NAT gateways have such a hard time with SFTP.

Setting up an SFTP control connection can be quite slow as compared to HTTP due to the round-trip delays of sending all of the required commands while waiting for a reply so typically the connection is held it open for multiple file transfers rather than dropped and re-established each time.

HTTP in comparison is stateless and multiplexes control and data over a single connection from client to server on well-known port numbers, which easily passes through NAT gateways and is simple for firewalls to manage and scan for security vulnerabilities.

Why might SFTP fall short as a complete secure file transfer solution as file transfer volumes increase?

As the volume of file transfers grows, the limitations of SFTP as a complete file transfer solution become apparent. The increasing demands for onboarding more partners, scaling infrastructure, and resolving technical issues can push the capabilities of SFTP to their limits, potentially overwhelming IT teams.

Additionally, the need for heightened security measures, strict control over file transactions, and robust visibility to comply with security and governance standards may exceed what SFTP alone can offer.

To address these challenges effectively, organizations may find that managed file transfer (MFT) solutions offer a more comprehensive approach. Utilizing a cloud-based service like Thru, which harnesses various protocols such as SFTP among others, can provide enhanced end-to-end security measures, precise tracking mechanisms, detailed logs, and long-term retention settings.

Moreover, MFT solutions like Thru can offer increased availability to ensure that file transfer operations remain seamless even as volumes continue to increase.

How does an SFTP server authenticate with a client?

To authenticate with a client, an SFTP server initiates a three-way TCP handshake to establish a connection. This process ensures that the server and client both have access to the correct port (usually 22) in the transport layer.

Following this verification, the server uses SSH key pair authentication to validate the client’s identity. The SSH key pair consists of a public key (shared between the two parties) and a private key (known only to the authorized client). Once the SSH authentication is successfully completed, the file transfer takes place over an encrypted channel, with data packaged into individual packets.

These packets are transmitted and reassembled at the receiving end to reconstruct the original file securely.

SFTP Port Alternative

SFTP protocol has been around since 1980 as a mechanism for transferring files. Enterprises will rightfully remain cautious when allowing or considering the support costs of direct SFTP port access to any internal resource from external networks over the FTP/SFTP protocol.

In the meantime, MyWorkDrive already converts Windows based file shares into secure file shares that can be accessed securely anywhere using TCP https/SSL port 443 over highly encrypted RSA 4096 and TLS 1.2 FIPS compliant protocols without the security or training concerns of SFTP.

MyWorkDrive SFTP port alternative supports remote workers with our secure Web Brower based access, Windows Mapped Drive, and Mobile clients.

Need help planning your SFTP alternative? Book a call and we’ll be happy to assist you in planning your deployment.

Book Call

Conclusion

In conclusion, SFTP is a secure file transfer protocol that uses public key cryptography to enable data-in-motion encryption, authentication, digital signing, and data integrity mechanisms. Understanding SFTP port management and server configuration is essential for secure file transfers.

By following best practices for SFTP usage, including establishing consistent naming conventions and folder structures, optimizing file transfer performance, and monitoring and logging all SFTP activities, organizations can ensure the security and integrity of their data.

Proper management of the secure file transfer protocol, along with careful configuration of the SFTP server, can help organizations achieve reliable and secure file transfers, protecting their data from unauthorized access and ensuring compliance with security standards.