Allow SFTP without Shell?

[bvierra]

most of the attacks are from exploits in software on the server, not from hacking of ftp passwords.

SFTP is a good idea as it is more secure. However it is not an end all

[jroll9]

bvierra - funny you should say that - I go to this post searching for ways to secure the connection for the very reason you mention. But I understood from all of my study of the exploit - sometimes referred to as the "GUMBLAR" virus - that they finally found it to end up creating a node on your network that could sniff clear text ftp packets. So encrypting the packets would take care of that it would seem.

I would very much appreciate any info you have on it - I had 3 website hacked with that iframe upload deal through a virus on one of my team's computers, and it's clear that the ftp user/pswd was compromised.