TLS/SSL

TLS and SSL is a cryptographic communication protocol that provides a way of securing protocols such as FTP or HTTP. Despite the name difference, TLS and SSL are different versions of the same protocol.

The server supports all modern and secure versions including TLS 1.3 and 1.2..The list of supported extensions includes:

• Renegotiation Indication Extension (RFC 5746), which increases resistance against attacker trying to hijack TLS/SSL connection during renegotiation in some scenarios.

Documentation links:

• https://www.rebex.net/doc/buru-sftp-server/features/ftp/
• https://www.rebex.net/doc/buru-sftp-server/web-administration/https/

SSH security

SSH is a secure communication protocol that provides secure communication for transferring files over SFTP, running commands remotely over the SSH shell, or operating secure SSH tunnels. See also SSH protocol section.

SSH algorithms security levels

You can set the security level of your transmissions to suit your specific needs. Buru allows you to specify allowed key exchange, host key, encryption, and message authentication checking (MAC) algorithms:

Secure only

Only the best. Older client applications may have compatibility issues.

Examples: edcsa-sha2-nist521, ssh-ed25519, rsa-sha-256, aes256-ctr, aes256-gcm@openssh.com.

Best compatibility

Still quite secure, but makes it possible for older clients to connect as well. This is the default setting.

Examples: ssh-rsa, ssh-dss, aes256-cbc, twofish-cbc, diffie-hellman-group14-sha256.

All (not recommended)

We understand that sometimes you have no choice but to support even the oldest legacy client applications and you can take care of the transport path security in other ways. That's why we support this mode as well. However, we definitely do not recommend running anything connected to the Internet or containing sensitive data in this mode. Use only at your own risk.

Examples: arcfour, blowfish-ctr, hmac-md5, diffie-hellman-group1-sha1

Fine-tuning in configuration file

If you are not satisfied with any of the predefined levels, you can enable or disable specific algorithms in the configuration file.

See list of all supported security algorithms.

Certificates

X.509 certificates are used for securing TLS/SSL connections, such as FTPS and HTTPS. X.509 certificates are supported in SSH as well.

Supported formats:

• PKCS #12 (.pfx, .p12)
• DER-encoded X.509 (.cer, .crt, .der, .pem)