Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

First thing i want to apologize if this question is silly or something...i just tried to research but it seems to be a bit hard to find exactly what i want in Google ! [or i'm not smart enough to find this :lol:]

I want to transfer files between to machines over the internet, in a SECURE way. Both machines have linux (the "server" uses Ubuntu 12 and the "client" uses Mint 14). I DO NOT want to allow ssh to my server, and i want the client to be able to open and read files on server, but it cannot modify/erase things. It's allowed to client copy files to server [or create files there] and copy from server.

I want to share just some directories in my server in the way above explained. Finally, i want to access files in the client in a easy fashion, like GUI mode or something..not using shell, but instead using a windows-like style (like if my remote folder is a local one, but with restrict access as above explained).

Being secure to me means that the connection must be encrypted, and the login could use some private/public key scheme.

What's the best solution for me ? I'm trying to find some SFTP configuration that fits my "specification", but the restriction in access is too "peculiar"...i don't know even if SFTP works without allowing ssh.

Thanks very much for any help...

EDIT: Thanks very very much for your help. I really appreciate this! I will evaluate all answers and try to figure out the best solution. By now, i think creating an user that have restricted access/privileges and allowing ONLY this user to do a SSH/SFTP ultra-secured is the best way..."hacks" to avoid ssh really can make things worse (less-secure). My question is a little bit confusing because my "logic" was a little disturbed. Now i can see more clearly...

I'm really sorry that i did "crossposting"...in fact i did it and regret for that. Thanks for the advice..i won't do this again !

share|improve this question
    
Did you consider sftp? Ok sorry site-to-stie VPN then. –  Danila Ladner May 7 '13 at 18:55
1  
I want a pony but you can't always get what you want - how about a VPN and some permissions? –  Chopper3 May 7 '13 at 19:00
2  
VPN seems like the only sane option here based on what I'm reading but my question is why are you opposed to ssh? It's pretty solid and secure when set up correctly. You can use denyhosts, lock it down a million ways, change default port etc. –  egorgry May 7 '13 at 19:05
2  
If you could explain your aversion to ssh, it may make it easier to suggest an alternative, but ssh and rsync are likely to be the best possible solution here. –  Johnsyweb May 7 '13 at 19:11
1  
The question is confusing. Just a tiny bit of research would find that SCP and SFTP are SSH-based programs. Yet your question asks how to "transfer without SSH", and at the same time you say that you are trying to find an SFTP configuration. –  ZaSter May 7 '13 at 19:58
show 11 more comments

6 Answers

The good old File Transfer Protocol (FTP) was invented for transferring files. To use it in a secure way, you can use ftps (which is not sftp, but ftp over ssl) or set up a vpn connection for security.

When I search for vsftpd+ssl, this is the first result which seems like a reasonable starting point.

share|improve this answer
add comment

You could setup a WebDAV file system over SSL.

share|improve this answer
    
Isn't webdav an extension of the HTTP protocol? So files on the disk will be owned by webserver user? –  Danila Ladner May 7 '13 at 19:15
add comment

You can use any protocol, even unencrypted and without authentication. All you have to to is to sign and encrypt your data before you send it:

gpg --armor --local-user senderkey --recipient recipientkey --sign --encrypt cleartextfile

If you are paranoid about login possibilities on the target you can use a combination of

  1. some network event (that does not open a connection) which is logged by Netfilter (iptables)
  2. a wget call which is triggered by the logging and gets the file from some web server (the OpenPGP file probably needs to always have the same name then)
share|improve this answer
add comment

Try WebDAV. It's my favourite protocol for accessing files on my NAS.

share|improve this answer
add comment

Seems to me you should be able to restrict the user to just sftp by adding a command="..." directive to the users authorized_keys file. We're doing that at $work to restrict some user accounts to just rsync.

There's a wite-up at http://troy.jdmz.net/rsync/index.html that lays out the process for rsync.

share|improve this answer
add comment

"Is there a way to limit the SSH access on my server, and then only my client could do ssh/sftp into it?"

Sure. A strong password/passphrase or key-based authentication would suffice for this. If you want to further indulge your paranoia, firewall off port 22 except for the IPs that should have access, or add Google Authenticator's one-time-password PAM module for two-factor authentication.

As the industry's gold standard for remote access to servers, properly secured SSH is going to be a lot more secure than a hacky workaround based on the sole requirement of "no SSH".

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.