Using sftp to upload web pages

1. ftp and Why You Shouldn’t Use It

First, it would probably be helpful to define ftp and sftp. ftp is the File Transfer Protocol, used for downloading and uploading files to servers. sftp does the same thing, only it uses an encrypted channel between your computer and the server you are connecting to. Why is the encryption a big deal? Well, ftp sends your user name, password, and data in clear text which is A Bad Thing. You may not care who snoops your data (it’s going to be published on the web anyway for the whole world to see, right?), but you should protect your login information to prevent somebody doing malicious things to your data (or causing problems on my server).

2. sftp and Why You Should Use It

Well, I guess the basic question is answered above. What is more to the point, you have to use it. The new web server will not provide ftp service, for the reasons stated above. It does provide sftp, and the other tools associated with ssh (the Secure Shell).

3. The problem With sftp

Because there is always a catch, right? The problem actually lies with some web authoring programs, namely Frontpage and older versions of Dreamweaver do not support sftp. Dreamweaver MX 2004 and later versions support direct uploads using sftp.

4. Getting Around the Problem

It’s not really a problem with Dreamweaver MX 2004, you just need to change your ftp settings to sftp and point it to your directory on the new web server.

If you are using one of the other programs, it means an extra step. Use a program such as CoreFTP if you are a Windows user or Cyberduck if you are a Mac OS X user to transfer your local web directory to your server web directory. Both programs are easy to set up and use. It’s well worth the hassle to ensure that your pages don’t get defaced, replaced, or erased.

Mac users have another option, Fugu. It wraps up sftp, ssh, and scp in a nice graphical interface. A good write up is available at NewsForge.

5. One More Issue

To access your account on the web server, you will need to either be on campus or use the VPN client (available for download on campus).

Note: This is no longer true. All you need for our web server is an sftp client. A number of people have had trouble using the VPN client reliably from off-campus. Since ssh encrypts traffic, we don’t really need the VPN for that. What the VPN is useful for is allowing us to block remote log in attempts by Those Who Would Do Bad Things. Using strong passwords and protecting accounts will help combat that.