On 1/14/10 11:59 AM, "Alan Altmark" <alan_altm...@us.ibm.com> wrote:
> On Thursday, 01/14/2010 at 10:58 EST, "Stricklin, Raymond J" > <raymond.j.strick...@boeing.com> wrote: > >> Just as a matter of clarification, can I ask why someone would put login > >> credentials inside of an EXEC that calls FTP, in preference to making > use of >> NETRC DATA ? > > (cough) The security exposure and subsequent audit failure is the same, > whether you have a clear-text password in an EXEC or a NETRC file. In > either case, the password should be in clear-text only in flight, not at > rest. While at rest it should be encrypted (preferred), hashed, or > otherwise obscured. At minimum, stored in SFS where you can apply file-level security. > This is why user certficate support for Secure FTP is needed. Then you > won't need a password (unless the other end requires 2-factor > authentication). Ugh. Can we try to avoid more certificate-based stuff until there is a sane way to manage the things? That's why SCP is more widely used than SFTP; certificate management is a enormous pain. We won't go into the cost and extortion involved in getting external assurance for CA identities. ISAKMP would be a LOT less of a pain. Or GSS-API support.
