Changes for page SFTP Known Hosts

Summary

• Page properties (4 modified, 0 added, 0 removed)

Details

Page properties

Title

...	...	@@ -1,1 +1,0 @@
1		-SFTP Known Hosts

Parent

...	...	@@ -1,1 +1,0 @@
1		-Main.eMagiz Academy.Microlearnings.Intermediate Level.File based connectivity.WebHome

Default language

...	...	@@ -1,1 +1,0 @@
1		-en

Content

...	...	@@ -1,9 +1,13 @@
1	1	{{container}}{{container layoutStyle="columns"}}(((
	2	+= SFTP Security =
2	2
3		-In an earlier [[microlearning>>Main.eMagiz Academy.Microlearnings.Intermediate Level.File based connectivity.intermediate-file-based-connectivity-sftp-connectivity||target="blank"]], we discussed how to connect to an SFTP from eMagiz. Later on we zoomed in on an alternative security method to authenticate yourself at the SFTP. More on this can be found in this [[microlearning>>Main.eMagiz Academy.Microlearnings.Intermediate Level.File based connectivity.intermediate-file-based-connectivity-sftp-security||target="blank"]]. In this microlearning, we want to expand our knowledge and look at a way to store the unique fingerprint of the SFTP to avoid that someone else can pretend to be the SFTP when you want to send data (i.e. a "man in the middle attack").
	4	+In the last microlearning, we discussed how to connect to an SFTP from eMagiz. In this microlearning, we want to expand our knowledge and look at a more complex security configuration when connecting to SFTP instances. The configuration we are talking about is the private key configuration.
4	4
5	5	Should you have any questions, please get in touch with [[academy@emagiz.com>>mailto:academy@emagiz.com]].
6	6
	8	+* Last update: August 25th, 2021
	9	+* Required reading time: 9 minutes
	10	+
7	7	== 1. Prerequisites ==
8	8
9	9	* Basic knowledge of the eMagiz platform
...	...	@@ -15,18 +15,24 @@
15	15
16	16	By SFTP security, we mean: Making sure that the SFTP we connect to knows that we are indeed eMagiz
17	17
18		-* Each SFTP has a unique fingerprint that identifies the SFTP.
19		-* To prevent a "man in the middle" attack, this fingerprint needs to be stored client side.
20		-* There are two distinct methods to generate the known hosts file.
	22	+* Private key is unique per client
	23	+* Private key should only be known to the client
	24	+* Public key should be known to the SFTP (server), so they trust us when we set up the communication
	25	+* A private key comes with a passphrase
21	21
22		-== 3. SFTP Known Hosts ==
23	23
24		-In this microlearning, we want to expand our knowledge and look at a way to store the unique fingerprint of the SFTP to avoid that someone else can pretend to be the SFTP when you want to send data (i.e. a "man in the middle attack"). To retrieve the unique fingerprint of an SFTP you first need to connect to the SFTP in question. This way you can retrieve the unique fingerprint and secure it in a file for future use to prevent the "man in the middle attack".
25	25
26		-There are two distinct ways of retrieving and storing the unique fingerprint of the SFTP in a "known hosts file". The first option is portal based and the second option is command line based. The preferred option is the portal based one. Do note that the first option only works if the SFTP is **publicly** accessible without any IP restrictions.
	29	+== 3. SFTP Security ==
27	27
28		-If you are looking for some introductory reading into certificates, please check this [[microlearning>>doc:Main.eMagiz Academy.Microlearnings.Novice.Securing Data Traffic.novice-securing-your-data-traffic-what-are-certificates.WebHome||target="blank"]].
	31	+In the last microlearning, we discussed how to connect to an SFTP from eMagiz. In this microlearning, we want to expand our knowledge and look at a more complex security configuration when connecting to SFTP instances. The configuration we are talking about is the private key configuration.
29	29
	33	+* Private key is unique per client
	34	+* Private key should only be known to the client
	35	+* Public key should be known to the SFTP (server), so they trust us when we set up the communication
	36	+* A private key comes with a passphrase
	37	+
	38	+If you are looking for some introductory reading into certificates, please check this [microlearning](novice-securing-your-data-traffic-what-are-certificates.md).
	39	+
30	30	As the private key is yours, you can ask a trusted party to generate the key, or you could create it yourself. The latter part happens a lot when connecting to an SFTP. You could use a tool like PuttyGen to achieve this. As a result, you will have a keypair. The private key should be kept safely with you in eMagiz, and you need to share the public key with the SFTP server party. In this microlearning, I will not explain how PuttyGen works in detail. Instead, we will focus on the part in eMagiz. In eMagiz, we need to refer to the key file (linked under Resources), and we need to refer to the password we use to save our key file securely.
31	31
32	32	[[image:Main.Images.Microlearning.WebHome@intermediate-file-based-connectivity-sftp-security--private-key-config.png]]
...	...	@@ -37,19 +37,32 @@
37	37
38	38	Using this setting gives the server the option to verify if the communication request came from eMagiz (or at least from the party that holds the private key of eMagiz). This is an additional security measure to ensure data integrity and quality.
39	39
40		-== 4. Key takeaways ==
41	41
	51	+
	52	+== 4. Assignment ==
	53	+
	54	+Check within your project(s) whether an SFTP connection is secured with the help of private key construction.
	55	+This assignment can be completed with the help of the (Academy) project that you have created/used in the previous assignment.
	56	+
	57	+== 5. Key takeaways ==
	58	+
42	42	* Private key is unique per client
43	43	* Private key should only be known to the client
44	44	* Public key should be known to the SFTP (server), so they trust us when we set up the communication
45	45	* A private key comes with a passphrase
46	46
47		-== 5. Suggested Additional Readings ==
48	48
	65	+
	66	+== 6. Suggested Additional Readings ==
	67	+
49	49	If you are interested in this topic and want more information, please read the release notes provided by eMagiz. Furthermore, check out these links:
50	50
51		-* [[SFTP Outbound>>https://docs.spring.io/spring-integration/docs/2.2.6.RELEASE/reference/html/sftp.html#sftp-outbound||target="blank"]]
52		-* [[SFTP Session Factory>>https://docs.spring.io/spring-integration/docs/2.2.6.RELEASE/reference/html/sftp.html#sftp-session-factory||target="blank"]]
53		-* [[SFTP Authentication>>https://www.2brightsparks.com/resources/articles/sftp-authentication.html||target="blank"]]
	70	+* https://docs.spring.io/spring-integration/docs/2.2.6.RELEASE/reference/html/sftp.html#sftp-outbound
	71	+* https://docs.spring.io/spring-integration/docs/2.2.6.RELEASE/reference/html/sftp.html#sftp-session-factory
	72	+* https://www.2brightsparks.com/resources/articles/sftp-authentication.html
54	54
	74	+== 7. Silent demonstration video ==
	75	+
	76	+As this is a more theoretical microlearning, there is no video.
	77	+
55	55	)))((({{toc/}}))){{/container}}{{/container}}