PHP - FTP and localhost security.

zermattchris

Hi PHP gurus,

I'm eye-brows deep into a CMS project that's using PHP on the server, and am trying to find out some definitive info on using PHP's FTP functions and the impact that this will have on security.

My Question:
Does ftp'ing on localhost (transferring a file or changing permissions on the same machine) constitute a security issue?

Its clear to me that any ftp op over the net is inherently insecure (as user+pass, etc are transmitted in clear text), but need to find out if using ftp just on the localhost also suffers from this weakness. Not sure how someone would be able to sniff the packets if all was happening on localhost, but would be nice to know and not guess 😉

Any feedback would be greatly appreciated!

Cheers,
-Chris

uidzer0b

There isn't much you can do about the insecurity of the FTP protocol. If it's only local host then the attacker would have to be sniffing on lo - it's not that far fetched, but unlikely. Just out of curiosity; why have you chosen FTP for local file transfer?

zermattchris

We choose to try and use ftp as it allows us to have a solution that would work on a much wider range of hosts (various ISPs, with PHP5 & Apache), while letting us modify files on the server, without ending up with a big permission mess.

One of the things our project needs to be able to provide is the ability for the user to both use our browser based CMS to modify the site, as well as a normal ftp program (SFTP, etc). If files are being generated on the server with php, they will end up being the user/group from Apache, meaning that our clients wouldn't be able to modify those files with a traditional ftp program.

Using PHP's FTP functions allows us to solve all of our issues, except perhaps a potential security problem. I've done massive digging around on the web, but haven't been able to find any relevant infos regarding this particular use of ftp.

Another question: is it possible to use the PHP FTP funcs over SSL?

Cheers,
-Chris

foyer

[edit]...

yeah I think you can use PHP functions with FTPS. I found this comment on phpfreaks.. FTPS is supported starting from PHP 4.3.0, if you have compiled in support for OpenSSL