Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #162378 > unrolled thread

Re: Recommendation for FTP server

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Recommendation for FTP server Nicolas George <george@nsup.org> - 2015-12-31 17:40 +0100
    Re: Recommendation for FTP server Steve Matzura <sm@noisynotes.com> - 2015-12-31 18:10 +0100
      Re: Recommendation for FTP server Daniel Bareiro <daniel-listas@gmx.net> - 2015-12-31 18:20 +0100
        Re: Recommendation for FTP server Steve Matzura <sm@noisynotes.com> - 2016-01-01 01:20 +0100
          Re: Recommendation for FTP server Daniel Bareiro <daniel-listas@gmx.net> - 2016-01-05 02:30 +0100
      Re: Recommendation for FTP server Nicolas George <george@nsup.org> - 2015-12-31 18:50 +0100
        Re: Recommendation for FTP server Jude DaShiell <jdashiel@panix.com> - 2015-12-31 19:40 +0100
          Re: Recommendation for FTP server Steve Matzura <sm@noisynotes.com> - 2016-01-01 01:20 +0100
            Re: Recommendation for FTP server Jonathan Dowland <jmtd@debian.org> - 2016-01-05 12:00 +0100

#162378 — Re: Recommendation for FTP server

[Multipart message — attachments visible in raw view] — view raw

Le primidi 11 nivôse, an CCXXIV, Steve Matzura a écrit :
> ProFTPD? VSFTP? Something else? I'm needing a secure connection,
> non-SSH, because a lot of ssh built into FTP clients let you go
> wandering around outside your home area,

Never rely on client restrictions for security.

>					   unless there's a way to
> protect against that in the ssh configuration file, which I did look
> for but have not found.

Search for "chroot" in sshd_config(5). Also, search the web for "chroot
sftp".

Regards,

-- 
  Nicolas George

[toc] | [next] | [standalone]

#162388

On Thu, 31 Dec 2015 17:37:09 +0100, you wrote:

>Le primidi 11 nivôse, an CCXXIV, Steve Matzura a écrit :
>> ProFTPD? VSFTP? Something else? I'm needing a secure connection,
>> non-SSH, because a lot of ssh built into FTP clients let you go
>> wandering around outside your home area,
>
>Never rely on client restrictions for security.

Surely not.

>>					   unless there's a way to
>> protect against that in the ssh configuration file, which I did look
>> for but have not found.
>
>Search for "chroot" in sshd_config(5). Also, search the web for "chroot
>sftp".

That locks the user in their home directory, but I have to give them
access to other things outside that directory, just not let them go
walking around and get into any other directory on the system. That's
why I was thinking of VSFTP, which locks the user into their home
directory, doesn't use ssh, uses TLS or something else, and lets the
administrator define a list of places where the user can go.

[toc] | [prev] | [next] | [standalone]

#162389

[Multipart message — attachments visible in raw view] — view raw

Hi, Steve.

On 31/12/15 14:07, Steve Matzura wrote:

> That locks the user in their home directory, but I have to give them
> access to other things outside that directory, just not let them go
> walking around and get into any other directory on the system. That's
> why I was thinking of VSFTP, which locks the user into their home
> directory, doesn't use ssh, uses TLS or something else, and lets the
> administrator define a list of places where the user can go.

If the user has to access different directories trees, then maybe you
could use the "bind" mount option for that from a single path the user
can access to paths that are not included each other.

I hope this is useful.

Best regards,
Daniel

[toc] | [prev] | [next] | [standalone]

#162416

Yes, very helpful. I'll look at mount options.

Here's what I did on the old Windows server:

Each user had their own login.

All logins sent to the same read-only area, with one subdirectory in
which all users could write. I know how to set that all up with
regular FTP servers like ProFTPD.

Other subdirectories were symbolically linked to the user login
directory. Sounds like mounting these remote shares at, or as, mount
points in the user login directory would be the proper thing to do,
yes? Then ssh for FTP would work just fine.

On Thu, 31 Dec 2015 14:19:05 -0300, you wrote:

>Hi, Steve.
>
>On 31/12/15 14:07, Steve Matzura wrote:
>
>> That locks the user in their home directory, but I have to give them
>> access to other things outside that directory, just not let them go
>> walking around and get into any other directory on the system. That's
>> why I was thinking of VSFTP, which locks the user into their home
>> directory, doesn't use ssh, uses TLS or something else, and lets the
>> administrator define a list of places where the user can go.
>
>If the user has to access different directories trees, then maybe you
>could use the "bind" mount option for that from a single path the user
>can access to paths that are not included each other.
>
>I hope this is useful.
>
>Best regards,
>Daniel

[toc] | [prev] | [next] | [standalone]

#162626

[Multipart message — attachments visible in raw view] — view raw

I'm sorry. It seems that I replied to this mail privately.

On 04/01/16 08:27, Daniel Bareiro wrote:
> Hi, Steve.
> 
> Happy New Year! (and to all members of the list!)
> 
> On 31/12/15 21:16, Steve Matzura wrote:
> 
>> Yes, very helpful. I'll look at mount options.
>>
>> Here's what I did on the old Windows server:
>>
>> Each user had their own login.
>>
>> All logins sent to the same read-only area, with one subdirectory in
>> which all users could write. I know how to set that all up with
>> regular FTP servers like ProFTPD.
>>
>> Other subdirectories were symbolically linked to the user login
>> directory. Sounds like mounting these remote shares at, or as, mount
>> points in the user login directory would be the proper thing to do,
>> yes? Then ssh for FTP would work just fine.
> 
> At this moment I do not remember why I had used the technique of
> mounting using "bind" instead of using symbolic links. I think I had
> tested the use of symbolic links and it does not worked.
> 
> In any case, this mounting technique using "bind" can be use with both
> SFTP and FTP servers (both chrooted).
> 
> 
> Best regards,
> Daniel

[toc] | [prev] | [next] | [standalone]

#162396

[Multipart message — attachments visible in raw view] — view raw

Le primidi 11 nivôse, an CCXXIV, Steve Matzura a écrit :
> That locks the user in their home directory

That locks the user in any directory of your choosing. Choosing the home
directory is the most common case, and therefore the one you find explained,
but not the only option.

Regards,

-- 
  Nicolas George

[toc] | [prev] | [next] | [standalone]

#162403

If I were setting up an ftp server, I would create a /pub directory in 
/home and would also create a /home/pub/incoming directory then lock any 
guest into the /home/pub and /home/pub/incoming directories.  The 
/home/pub directory would be where I'd put files available for download 
and the /home/pub/incoming/ directory is where guests could upload files 
if they wanted to do so.  You'll find that setup on many professional 
ftp servers that have been on the internet for many years by now.

On Thu, 31 Dec 2015, Nicolas George wrote:

> Date: Thu, 31 Dec 2015 12:45:49
> From: Nicolas George <george@nsup.org>
> Reply-To: debian-user@lists.debian.org
> To: Steve Matzura <sm@noisynotes.com>
> Cc: debian <debian-user@lists.debian.org>
> Subject: Re: Recommendation for FTP server
> 
> Le primidi 11 niv?se, an CCXXIV, Steve Matzura a ?crit :
>> That locks the user in their home directory
>
> That locks the user in any directory of your choosing. Choosing the home
> directory is the most common case, and therefore the one you find explained,
> but not the only option.
>
> Regards,
>
>

-- 

[toc] | [prev] | [next] | [standalone]

#162415

On Thu, 31 Dec 2015 13:33:44 -0500 (EST), Jude wrote:

>If I were setting up an ftp server, I would create a /pub directory in 
>/home and would also create a /home/pub/incoming directory then lock any 
>guest into the /home/pub and /home/pub/incoming directories.  The 
>/home/pub directory would be where I'd put files available for download 
>and the /home/pub/incoming/ directory is where guests could upload files 
>if they wanted to do so.  You'll find that setup on many professional 
>ftp servers that have been on the internet for many years by now.

Sounds a good plan, except everything available for download is on
remote shared places.

[toc] | [prev] | [next] | [standalone]

#162645

On Thu, Dec 31, 2015 at 07:16:39PM -0500, Steve Matzura wrote:
> Sounds a good plan, except everything available for download is on
> remote shared places.

You should be able to mount or bind-mount those into the /pub* area.

Last time I ran something like this I used vsftpd which was pretty good,
but I'd be hesitant to run an FTP server again myself.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web