Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We need to securely serve files to our clients. We want the transport to be encrypted, users should require user/password and they should be able to access their files through the web, ftp/sftp and curl.

The obvious idea is to use openssh and its sftp server. However, I don't see how to provide a web interface to the sftp server.

In other words, while most clients will use automated scripts to get their files, they may have an occasional need to get the files manually from a web page (which means they need to manually type in their user/password)

Any ideas?

edit: Sorry, forgot to mention that we intend to serve these files off a linux server

share|improve this question
add comment

8 Answers

up vote 2 down vote accepted

Having "sftp://" links will indeed require you have a sftp-capable client registered to handle the sftp UNC and will also require a re-login unless you provide the username/password in the unc... i.e. sftp://user:password@x.x.x.x/path/file. This really defeats the purpose of having a separate sftp server from the http server.

Why not simply establish a HTTPS session with whatever authentication method you choose to use, and let the http server dish out the files? If you're using apache, you can allow directory browsing, and it will auto-generate the directory listing from a specific directory... and you can make the sftp pull from the same directory. (if you wish to use both)

If you are stuck on using sftp... don't forget to restrict user logins using ssh to ONLY allow sftp and/or scp... or you will be leaving yourself open to a big security hole.

share|improve this answer
    
This sounds interesting...but some things aren't clear to me. Can you point me to some material that shows how to do this? --developer trying to do admin stuff :) –  user23398 Aug 30 '10 at 17:57
add comment

Have you considered the File Manager inside Usermin? You can serve Usermin over HTTPS and that will be secure, and while you didn't mention what OS you're using, Webmin/Usermin are available for a wide variety of systems.

share|improve this answer
    
Looks like usermin/webmin is for internal users, rather than external clients who should never see options to change passwords, add/remove users, etc. Did I misread the usermin page? –  user23398 Aug 30 '10 at 17:28
1  
It does look like UserMin is meant for what you say, but @Josh was specifically calling out the File Manager component of it, which should do what you want. It does upload and download, according to the docs. Just make sure the users have no rights to anything you don't want them to. –  mfinni Aug 30 '10 at 17:46
    
@mfinni that's correct. I wasn't aware of any other web based sftp solutions so I figured I'd suggest usermin. There may be better alternatives out there that I'm not familiar with. –  Josh Aug 30 '10 at 18:41
add comment

You'll want them to login over HTTPS and provide download links via https:// and change the content-type so the files don't load in the browser window.

You may be able to provide sftp:// links but they will only work if the users have a properly configured client and will likely require that they login again.

share|improve this answer
    
I'm trying to avoid the need to 'provide download links' myself. I was hoping for a simple web front-end to an sftp server that does this for me. –  user23398 Aug 30 '10 at 17:28
    
If you turn on "Directory Indexing" on the HTTP server the links are generated automatically. Be careful because it's easy to expose files you didn't intend to put online (but that happen to be co-located with those you did) with this method. –  Chris Nava Mar 14 '11 at 5:05
add comment

Why do is there a requirement for sftp? Have you considered just setting up an webdav? With webdav users will be able to but put and get files directly via HTTP(S).

share|improve this answer
add comment

maybe this will help ?: http://sftp.thinfile.com/sftp/

share|improve this answer
add comment

You could always provide a short tutorial on how to download and use an SFTP client, for those occasional uses.

share|improve this answer
add comment

Fire FTP plugin (only) for Firefox web browser.

share|improve this answer
add comment

Look at using AnyClient. It's a free web based service that allows users to connect to FTP/S, SFTP, WebDAV and Amazon S3 services from a webpage without having to install any client software.

http://www.jscape.com/products/file-transfer-clients/anyclient/

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.