3

I need to setup a site to share files with clients. Everything about it has to be secure so, I don't want to use straight FTP. The other requirement is that it has to be easy to use as the people that are going to be transferring files are by no means technically inclined. I've gone down the SFTP/SCP road with linux using chroot jails, but have not gotten past the need for a client on the end user's workstation.

Thought? Suggestions?

Thanks in advance!

2
  • 4
    Secure and easy almost never go hand in hand... :|
    – Zoredache
    Aug 13, 2009 at 19:12
  • Have you already got an SFTP solution? This, and other secure transfer mechanisms, is supported on the FireFTP Firefox add-on. It offers a simple graphical end-user interface, if that's what you want.
    – mas
    Aug 13, 2009 at 19:14

12 Answers 12

4

HTTPS WebDAV?

Then they can use Windows Explorer, though I haven't tested the realm of client authentication for WebDAV Explorer integration. You may be able to use .htaccess ACL's or other Auth modules, or client certificate mappings.

My preference: Even without DAV, you could set up a regular HTTPS site that takes care of authentication, and give them a URL.

2
  • I only suggested DAV because of potential Explorer integration. But chances are, they have a Web browser. Unless they're in Europe, and didn't install Opera or IE.
    – mpbloch
    Aug 13, 2009 at 19:15
  • To avoid writing a Web page even, if you use Apache, set the Options +Indexes for wherever you serve your files.
    – mpbloch
    Aug 13, 2009 at 19:32
2

WinSCP is freeware and very easy to use. It has the ability to virtually edit files remotely (by downloading them temporarely and watching for changes), which is a very handy feature. It is used at the small/medium sized enterprise where I work as SFTP/SCP client on Windows machines.

2

mpbloch is rihgt, WebDAV over HTTPS.

WebDAV shares are accessible from almost any OS with standard tools:

Windows users can do so using the "Add Network Place Wizard"

Mac users can use "Connect to Server" (Command+K in Finder).

Linux users with most of file browsers like: Nautilus or Konqueror.

With Apache you can implement authentication in many ways with Auth modules like: passwords, LDAP, User SSL certificate, etc...

1

Filezilla supports SFTP connections.

1

I recomend MOVEit DMZ from Ipswitch (aquired from Standard Networks last year).

I have used this product in production for 3 1/2 years now and it's rock solid and easy for clients to use.

It exposes a simple web interface that clients can use to upload and download files over HTTPS. It also exposes SFTP and FTP over SSL. I know that you indicated that you wanted to stay away from these becuase of the technical nature vs. your users. However, with this solution your user can chosse what method they are comfortable with.

Antoher huge benefit is that all data stored on the server is encrypted while at rest.

It's a great solution.

0

For the client, I'd look at SecureFTP:

http://www.glub.com/products/secureftp/

This started as a project for a National Lab a few years ago and has really groen up.

1
  • OP seems to prefer NOT having a client required on the user's workstations. OP has tried SFTP.
    – mpbloch
    Aug 13, 2009 at 19:31
0

We had a similar situation, and FileRun fit perfectly for us. There's some tripping points, but not enough for us to not go with it. I posted a quick review on my blog. Wrap the PHP app in HTTPS, and you have pretty good security with hard-to-beat usability.

0

You could try looking into solutions that authenticate users dynamically through a login form of some kind, then use the X-SendFile header behind an apache or lighttpd server (or X-Accel-Redirect behind nginx) to serve up files to authenticated users. This would allow you to have per-file permissions for users or groups, but it might be a bit more work than other solutions.

0

HTTPS WebDAV is perfect in your situation. By the other hand, you can use a free service (or pursache a VIP account) in DropBox. It can transfer files under SSL AES-256, and store the files in the cloud crypted.

0

Our company uses CrushFTP and like it a lot. It gives you FTP, HTTP and SSL options we just use the HTTPS. Its not really FTP when using the SSL, more like a website with an upload option. But I find SSL use better as some of our clients block FTP access, almost no one blocks SSL.

0

You could use FireFTP extension for Firefox. It supports all encryption / authentication methods. http://fireftp.mozdev.org/

0

Not sure what your budget is, but globalscape works pretty well. It also allows for upload/download via a web interface OR using a client.

You must log in to answer this question.