我创建了一个 Delphi 2010 应用程序。该地区的许多公司（从受信任的用户到不受信任的用户）都在使用它。该应用程序使用 MySQL MD5 加密密码对用户进行身份验证。接下来，应用程序需要通过 ftp 上传和下载许多文件。
事实是：任何网络嗅探器（例如 Ethereal 也称为 WireShark）都可以从我的应用程序的 ftp 部分获取我的普通用户和密码。加密的密码也可以被窃取，任何人都可以使用任何 ftp 应用程序登录到我的服务器并做出不愉快的事情。
[TindyFTP] 用于管理 FTP 连接本身。这个对象不支持 SFTP，我认为这可能是我的问题的结束。
DEVART 的[tMyMac] 用于管理 MYSQL 连接。
现在我的观点是什么：
使用 SSH 隧道来控制我的应用程序上的两种（ftp 和 mysql）事务类型的 IO 处理程序是一个好方法吗？我现在正在使用 DEVART 的 SecureBridge 进行一些测试，该测试兼容带有 MyDAC 组件和 TIndy。
我是否只需要连接到 SSH 隧道并使用 mysql 和 ftp 进行操作？
使用 SSH 隧道时是否还需要加密 ftp 密码？
对于 MySQL 部分，当我尝试使用 WireShark 拦截密码时，密码似乎被加密或混淆。
感谢您让我知道您的想法，而无需更改我的程序的所有结构，该程序已完成 99％:)
谢谢，
乔纳森
I created a Delphi 2010 application. It is use by many company in the region from trusted to untrusted users. The application authenticate users with MySQL behind MD5 encrypted password. Following this, the application need to upload and download many files trought ftp.
The fact is : any network sniffer (such as Ethereal also known as WireShark) can grab my plain user and password from the ftp part of my application. Encrypted password can also be grab and anyone can log with any ftp application to my server and make unpleaseant things.
[TindyFTP] is used to manage the FTP connexion itself. This object those not support SFTP which I tought that could be the end of my problem.
[tMyMac] from DEVART is used to manage MYSQL connexion.
What is my point by now :
It is a good way to use SSH Tunneling to control the IO Handler of both (ftp and mysql) transaction type onto my application ? I'm doing some test right now with SecureBridge from DEVART which is compatible with MyDAC component and TIndy.
Do I simply need to get connected to SSH Tunnel and go trought it with mysql and ftp ?
Do I also need to encrypt ftp password while using SSH Tunnel ?
For the MySQL part, the password seem to be encrypted or obfuscated when I try to intercept it with WireShark.
Thanks to let me know your idea from that point without changing all the structure of my program which is 99% completed :)
Thanks,
Jonathan
发布评论
评论（2）
首先，您需要确定您应该/可以使用什么协议。 FTP 不是 SFTP，并且基于 SSH 的 FTP 也没什么意义（尽管这是可能的）。让我们回顾一下选项：
如果你有一个Linux服务器（MySQL建议你有），那么它有OpenSSH作为SSH服务器，并且OpenSSH有内置的SFTP服务器。如果你在 Windows 上运行 MySQL，你将很难在 Windows 上使用 OpenSSH 端口，而 Bitvise SSH 服务器将是一个更好的选择（我们自己在内部服务器上使用它）。
如果 SFTP 身份验证和加密是在 SSH 级别执行的，则不需要
不必担心进一步保护用于身份验证的密码——它已经通过 SSH 进行了保护。不过，您需要关心的是验证服务器向客户端提供的 SSH 密钥。您可以通过在客户端模块中存储服务器密钥的副本来完成此操作（请记住，您可能需要不时替换服务器密钥，因此不要在客户端模块中对其进行硬编码）。
如果您决定采用 FTP-over-SSH 路线（尽管我不明白为什么您需要这样做），您仍然不需要保护 FTP 密码，因为您将通过安全 SSH 隧道运行 FTP。
First you need to determine, what exactly protocol you should / can use. FTP is not SFTP, and FTP over SSH makes little sense as well (though it's possible). Let's review the options:
If you have a linux server (MySQL suggests that you do), then it has OpenSSH as an SSH server, and OpenSSH has built-in SFTP server. If you run MySQL on windows, you will have hard time using OpenSSH ports on Windows, and Bitvise SSH server would be a better option (we use it ourselves on our internal server).
In case of SFTP authentication and encryption is performed on SSH level and you don't need
to bother further securing password used for authentication -- it's already secured with SSH. What you need to care about though is verify the SSH key, presented by the server to the client. You can do this by storing a copy of the server key in the client module (remember that you might need to replace the server key from time to time, so don't hard-code it in the client module).
If you decide to go FTP-over-SSH route (though I don't see why you'd need this), you still don't need to secure FTP password as you will be running FTP over secure SSH tunnel.
Indy 10 中的 TIdFTP 确实支持连接级别 (SSL/TLS) 和登录凭据级别 (SASL) 的加密。
TIdFTP in Indy 10 DOES support encryption, both at the connection level (SSL/TLS) and the login credential level (SASL).