Copying Files Securely Between Systems

If you need to copy files from one system to another over an unprotected network, you can do it in a few ways. For example, you can employ the RRAS component that comes with Windows Server 2003 and Windows 2000 Server to establish a VPN that uses PPTP; you can use Microsoft IIS and Secure Sockets Layer (SSL) connections along with a custom Web interface; or you can use Secure Shell (SSH). There are other ways to accomplish this task, but these are probably the most common solutions.

If you're interested in setting up RRAS and PPTP, you can find instructions in the Microsoft article "Step-by-Step Guide for Setting Up a PPTP-based Site-to-Site VPN Connection in a Test Lab" (URL below). This is a good solution, especially if you want to use the VPN for other tasks.

http://www.microsoft.com/downloads/details.aspx?FamilyID=7424168e-f745-4450-b671-aac2c79568eb&DisplayLang=en

Using IIS and SSL is simple enough, but it does require you to design a Web interface that meets your needs. For example, designing for downloading files is easy enough, but you'll need a script or ActiveX control for uploading files. This method also requires that you expose the IIS system to some extent, which you might not want to do.

The third method, using an SSH server, might be a better solution. SSH servers provide encrypted transports between clients and servers by using a variety of encryption methods, including Triple DES (3DES), Blowfish, CAST (named after its developers Carlisle Adams and Stafford Tavares), Advanced Encryption Standard (AES), and possibly others, depending on the software you use. Another benefit is that SSH can use public keys instead of passwords to authenticate a session. Plus, SSH servers offer cross-platform support--versions are available for just about every popular OS, including Linux and BSD, as well as Sun Microsystems and Apple platforms.

By using SSH, you can not only copy files securely, you can also open a secure Telnet session (using a special shell client) to a remote server, which might come in handy for remote administration. In addition, you can tunnel unencrypted services over SSH connections. For example, by using port forwarding, you can run SQL traffic, POP3 traffic, and many other types of service traffic over SSH connections.

Several commercial and open-source SSH servers are available for Windows. If you want a robust commercial solution, check out the products at SSH Communications Security (at the first URL below) or AttachmateWRQ (at the second URL below). If you want an open-source solution, consider OpenSSH for Windows (at the third URL below) or freeSSHd (at the fourth URL below). Both open-source solutions can run as a system service; freeSSHd offers a simple GUI interface, OpenSSH doesn't.

http://www.sshcommunications.com/products/tectia

http://www.wrq.com/products/reflection/ssh/

http://sshwindows.sourceforge.net

http://freesshd.com

If you run Windows 2003, a step-by-step tutorial is available to help you install OpenSSH for Windows. "Installing OpenSSH for Windows 2003 Server - How to get it working," by Steve Pillinger, senior computer officer at the School of Computer Science at the University of Birmingham in England, describes how to set up user accounts, assign user rights, set file permissions, and configure authentication.

http://www.cs.bham.ac.uk/~smp/projects/ssh-windows

If you run Win2K Server, you can use Beau Monday's step-by-step guide, "Configuring OpenSSH (Win32) for Public Key Authentication." His guide is equally detailed and includes information about how to configure PuTTY, which is an open-source SSH command-line client for Windows platforms. The PuTTY package also includes a PuTTY Secure Copy (PSCP) client. If you use Monday's guide, take note that his link to OpenSSH for Windows is broken. The project has relocated to SourceForge, and you can find it by using the second URL below.

http://bmonday.com/articles/653.aspx

http://sshwindows.sourceforge.net

I've used the PuTTY PSCP client quite a bit, and even though it's a good tool, I prefer a GUI because it saves me a whole lot of typing. With a GUI, you can copy files using simple drag-and-drop techniques, and you can typically navigate directories in a treeview similar to that of Windows Explorer. As an alternative to PuTTY, you might consider WinSCP (at the URL below) for file-copying tasks. WinSCP supports both Secure Copy (SCP) and Secure FTP (SFTP).

http://winscp.net/eng/index.php