Stop Bleeding Data: The Case Against FTP in 2011
It is April 2011. Nginx 1.0 just launched, ushering in a new era of performance, yet I still see seasoned systems administrators moving sensitive customer data over standard FTP on Port 21. This isn't just lazy; it is professional negligence.
If you are managing servers in Norway, you are operating under the purview of Datatilsynet and the Personal Data Act (Personopplysningsloven). If a script kiddie sits on the same open Wi-Fi network as your developer and runs a packet sniffer while they upload code, your root password is gone. Plain text. Visible to anyone running Wireshark.
It is time to kill FTP. The industry standard replacement is not the firewall-nightmare known as FTPS (FTP over SSL), but SFTP (SSH File Transfer Protocol).
The Anatomy of a Disaster (Why FTP Fails)
Let’s look at what happens when you authenticate via standard FTP. If I run a simple tcpdump on the gateway, here is what I see:
USER admin
PASS supersecret123
That is it. Game over. On a shared hosting environment, this traffic often traverses internal networks that you do not control. This is why at CoolVDS, we advocate for full virtualization (KVM or Xen) where you control the entire stack, rather than shared cPanel accounts where your security depends on your neighbor's competence.
Implementing Chrooted SFTP on CentOS/Debian
Many admins hesitate to give developers SFTP access because they believe it requires giving them a full shell (SSH) to the server. They worry a junior dev will accidentally run rm -rf /. This is a misconception.
Using OpenSSH (standard on all our CoolVDS templates), we can restrict users to SFTP only and lock them into a specific directory (chroot). This provides the security of encryption with the isolation of traditional FTP.
1. Configure SSHD
Edit your /etc/ssh/sshd_config file. We are going to use the internal-sftp subsystem which does not require external binaries within the chroot jail—a massive time saver compared to the old ways of copying /bin/bash libraries.
# /etc/ssh/sshd_config
# Comment out the old subsystem
# Subsystem sftp /usr/lib/openssh/sftp-server
# Use the internal subsystem
Subsystem sftp internal-sftp
# Match the group for your web developers
Match Group sftpusers
ChrootDirectory /home/%u
ForceCommand internal-sftp
X11Forwarding no
AllowTcpForwarding no
2. Permissions Are Critical
The chroot directory must be owned by root and not writable by the user. If you mess this up, the connection will close immediately upon login. This is the most common support ticket we see.
# Create the group
groupadd sftpusers
# Create the user
useradd -g sftpusers -d /upload -s /sbin/nologin devuser
passwd devuser
# Set permissions (Root must own the chroot root)
mkdir -p /home/devuser/upload
chown root:root /home/devuser
chmod 755 /home/devuser
# Let the user own the inner directory
chown devuser:sftpusers /home/devuser/upload
Now, your developer can connect via FileZilla or WinSCP using port 22. Their connection is fully encrypted, but they cannot cd outside their folder, and they cannot run shell commands.
Performance: The SSD Advantage
Encryption adds CPU overhead. On legacy VPS providers overselling their Xeon cores, you might notice a drop in transfer speeds compared to raw FTP. This is due to the "context switching" penalty in older virtualization tech like Virtuozzo.
This is where infrastructure matters. At CoolVDS, we are rolling out Enterprise SSD storage across our nodes. While mechanical SAS drives struggle with the random I/O generated by multiple encrypted streams, SSDs handle the throughput effortlessly. Combined with our uncrowded KVM architecture, the latency overhead of SFTP encryption becomes negligible.
Pro Tip: If you are transferring massive backups between servers, don't use SFTP. Usersync -avz -e ssh. The compression flag (-z) combined with SSH keys will save you bandwidth fees and time, especially when routing through the NIX (Norwegian Internet Exchange).
The Compliance Argument
In Norway, data protection is not optional. If you store personal data (emails, addresses, phone numbers), you are a data controller. Using unencrypted protocols to manage this data could be viewed as a lack of "appropriate technical measures" under current legislation.
Don't risk a Datatilsynet audit just because you were too lazy to configure SSH keys. The transition from FTP to SFTP is seamless for the client but monumental for your security posture.
Conclusion
FTP belongs in the 1990s. It has no place in a modern 2011 infrastructure stack. It exposes credentials, invites man-in-the-middle attacks, and fails basic compliance checks.
Secure your workflow today. Spin up a CoolVDS SSD VPS, configure your keys, and sleep better knowing your data isn't floating through the internet in plain text.