Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a webserver running under Plesk 8.6 and I'd like to create a folder on it, where people can drop files and load files, accessible via FTP, but without login. The rest of the files and folders shouldn't be accessed, just this one particular folder. I thought it would go throught the "Anonymous FTP", but I can'T activate it using multiple IP.

EDIT: I used "Putty" to try to create a group and a user called "guest" with a password "guest", but it doesn't work, I can'T access the folder with that username and password.

share|improve this question
1  
Are you deliberately trying to setup a warez relay, or is that just a pleasant side-effect? –  womble Jan 14 '10 at 9:24
    
A what? I just to be able to have a folder where people (customer and coworkers) all over the world can drop their files, without authentification... It shouldn't be so complicated, is it? –  waszkiewicz Jan 14 '10 at 9:31
    
The problem is that within about 10 minutes of you setting it up, not just your customers and co-workers will be dropping their files in there -- open FTP directories attract illegal filesharers like flies to dog poop. Use something like dropshare (or a locally-hosted equivalent) which has a little bit of authentication on it. –  womble Jan 14 '10 at 9:35
    
I think it won't do it. And is it possible to add an account like: "guest" and the same as password? –  waszkiewicz Jan 14 '10 at 9:39
    
Any simple username/password you put on your FTP site will just be brute-forced and guessed -- so you might survive to 20 or 30 minutes before getting owned. And don't get snippy with me just because you had a bad idea -- it's far better than your next question to serverfault being "I just got an $18,000 excess network traffic bill and an arrest warrant for distributing child pornography, what could have happened?" –  womble Jan 14 '10 at 10:28

1 Answer 1

up vote 3 down vote accepted

This is a really bad idea, as any unauthenticated (or weakly authenticated, such as a guest account with a simple password) FTP service (or other file sharing service) will be quickly found and exploited by "warez" filesharers, or worse -- child pornography, credit card numbers, and anything else nefarious and illegal can quite easily end up on the machine.

A properly authenticated web-based filesharing service, like dropshare, dropsend, any of the dozens of clones thereof, or a self-hosted web service along similar lines, is a far better option. It's slightly harder to use, in the sense that people have to have logins, but you could provide short-term-use credentials (even just a 6 alphanumeric character token, that's valid for a day, is secure enough, and could easily be given out over the phone to customers by support staff) to make it easier.

share|improve this answer
    
Thank you for the warning and the details! –  waszkiewicz Jan 15 '10 at 14:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.