Secure Deployment
What Deployment means?
Moving to production/staging
-
code
-
databases
-
images
How Deployment ?
Security Risks ?
Clear Text Usernames, Passwords, File Transfers !
FTP Clients
FileZilla - Don't share PC with anyone
-
filezilla.xml
-
recentservers.xml
-
sitemanager.xml
Malwares
-
Harvests information from user machines
-
Injects malware to the websites
Affects
-
Filezilla
-
SmartFTP
-
FTP Navigator
-
Total Commander
-
Core FTP
-
and more...
Sniffers
FakeAV - Trojan variant of Troj/FakeAV-AAL
-
Installs itself
-
Downloads and install packet sniffer ( Troj/sniffer-R)
-
Listens to port 21
-
Sends the credentials to remote server
Anonymous FTP Servers
ftp ftp.FreeBSD.org
-
username: anonymous
-
password:
Secure Deployment Solutions
FTPS
FTP over SSL ( port 990 )
-
FTPS - Implicit SSL
- FTPS - Explicit SSL
SFTP
New protocol
Utilizes SSH
NOT Related with FTP
Port 22
Rsync
Not safe
Data not encrypted
rzync -zvr test.txt $HOME/Desktop
Rysnc over SSH
Safe
Data Encrypted
rsync -vzr -e ssh user@xxx.xxx.xxx.xxx:$HOME/test.txt $HOME/Desktop
Best Practices
Use SSL/TLS with a strong cipher
Configure the server right
Least Privilege
Correct Access Control
Remove unwanted files
Thank You
securedeployment
By rejah
