Using SFTP or other secure method to transfer index files

[mary]

I have scoured both the Zoom documentation and these forums, but have not found mention of a solution. Can Zoom be configured to use SFTP or another means of not sending clear-text FTP passwords during uploads? I ask because the integrated upload program is handy, yet insecure. Placing the Zoom FTP access account in a chrooted jail limits exposure, but a SFTP connection would be better.
Thanks!

[David]

Yes you are correct. While FTP is very popular and widely supported, it is not the most secure protocol.

The problem with SFTP is that there is no single standard. Many hosts don't support it and there are lots of different options (SSH2, SSL, TLS, etc..). So it is a lot of work for us if we need to cover all the options. And generally pretty confusing for even moderately experienced web designers.

So if you are concerned, some options are,

1) Set up a special FTP account with very limited permissions on the server. e.g. uploads to a single directory. You could even block access based on IP address if you wanted.

2) Use a 3rd party SFTP program to transfer files

3) Run Zoom directly on the web server (or on a machine local to the web server) and avoid the FTP step entirely. You need a Windows server for this.

-----
David

[mary]

David,

Thank you for the considered response. I realize SFTP is not as standard as one might wish. If adding SFTP functionality to Zoom is not possible, could one of several options be implemented instead? The first possibility that comes to mind is the ability to invoke another program after the indexing is complete. This would allow using a different, SFTP capable program to tansfer the index files. A second, albeit less generally useful, option would be to support HTTP file transfers with SSH included.

Thanks!