We discontinued running a FTP server, because1) passwords and data are usually transferred unencrypted via the FTP protocol. As we were aiming at a safe setup, we made the decision to offer SSH/SFTP only. Now don't worry – every fairly recent FTP Client should be getting along just fine with SFTP.
| Criteria | Value |
|---|---|
| protocol | SSH for shell access, SFTP for file uploads |
| server name | name of your server, e.g. ghost.puffinhost.com |
| port | 3389 |
| user name | your user name, usually starting with “u-” |
Key-based authentication is a method to sign in to your SSH account without entering your password. This doesn't necessarily mean it is less secure. In key-based authentication your “password” is a file only you have on your computer (the so-called private key). This file has a corresponding file2) at the server (the so-called public key). Only if these two files match, login is possible.
To use key-based authentication, you have to generate a private/public key pair (e.g. using PuTTY Gen on Windows or ssh-keygen on Linux and OS X). Keep the private key secret and on your computer and add the public key3) to your ~/.ssh/authorized_keys2 file (create it, if it doesn't exist), where ~ is your home directory.
Some FTP/SFTP software even supports key-based login, so you don't have to type your password, when uploading files.
The following is a list of programs that we know work with our setup, you are free to use others of course.
Log in using SSH, execute the passwd command and follow the steps. If you see no error messages, passwd completed and you see a propmt again, your password has been changed.
To choose a safe password, you should use at least 10 characters, upper and lower case letters, numbers and special characters. Make sure your password can't be found in a dictionary. We are currently not enforcing a minimum password complexity but might consider adopting a complexity check should accounts be compromised because of weak passwords. Remember the system is publically accessible and there's a lot of bad people out there trying to guess your passwords4).