Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to setup a site to share files with clients. Everything about it has to be secure so, I don't want to use straight FTP. The other requirement is that it has to be easy to use as the people that are going to be transferring files are by no means technically inclined. I've gone down the SFTP/SCP road with linux using chroot jails, but have not gotten past the need for a client on the end user's workstation.

Thought? Suggestions?

Thanks in advance!

share|improve this question
4  
Secure and easy almost never go hand in hand... :| –  Zoredache Aug 13 '09 at 19:12
    
Have you already got an SFTP solution? This, and other secure transfer mechanisms, is supported on the FireFTP Firefox add-on. It offers a simple graphical end-user interface, if that's what you want. –  mas Aug 13 '09 at 19:14
add comment

12 Answers

HTTPS WebDAV?

Then they can use Windows Explorer, though I haven't tested the realm of client authentication for WebDAV Explorer integration. You may be able to use .htaccess ACL's or other Auth modules, or client certificate mappings.

My preference: Even without DAV, you could set up a regular HTTPS site that takes care of authentication, and give them a URL.

share|improve this answer
    
I only suggested DAV because of potential Explorer integration. But chances are, they have a Web browser. Unless they're in Europe, and didn't install Opera or IE. –  mpbloch Aug 13 '09 at 19:15
    
To avoid writing a Web page even, if you use Apache, set the Options +Indexes for wherever you serve your files. –  mpbloch Aug 13 '09 at 19:32
add comment

Filezilla supports SFTP connections.

share|improve this answer
add comment

mpbloch is rihgt, WebDAV over HTTPS.

WebDAV shares are accessible from almost any OS with standard tools:

Windows users can do so using the "Add Network Place Wizard"

Mac users can use "Connect to Server" (Command+K in Finder).

Linux users with most of file browsers like: Nautilus or Konqueror.

With Apache you can implement authentication in many ways with Auth modules like: passwords, LDAP, User SSL certificate, etc...

share|improve this answer
add comment

I recomend MOVEit DMZ from Ipswitch (aquired from Standard Networks last year).

I have used this product in production for 3 1/2 years now and it's rock solid and easy for clients to use.

It exposes a simple web interface that clients can use to upload and download files over HTTPS. It also exposes SFTP and FTP over SSL. I know that you indicated that you wanted to stay away from these becuase of the technical nature vs. your users. However, with this solution your user can chosse what method they are comfortable with.

Antoher huge benefit is that all data stored on the server is encrypted while at rest.

It's a great solution.

share|improve this answer
add comment

For the client, I'd look at SecureFTP:

http://www.glub.com/products/secureftp/

This started as a project for a National Lab a few years ago and has really groen up.

share|improve this answer
    
OP seems to prefer NOT having a client required on the user's workstations. OP has tried SFTP. –  mpbloch Aug 13 '09 at 19:31
add comment

WinSCP is freeware and very easy to use. It has the ability to virtually edit files remotely (by downloading them temporarely and watching for changes), which is a very handy feature. It is used at the small/medium sized enterprise where I work as SFTP/SCP client on Windows machines.

share|improve this answer
add comment

We had a similar situation, and FileRun fit perfectly for us. There's some tripping points, but not enough for us to not go with it. I posted a quick review on my blog. Wrap the PHP app in HTTPS, and you have pretty good security with hard-to-beat usability.

share|improve this answer
add comment

You could try looking into solutions that authenticate users dynamically through a login form of some kind, then use the X-SendFile header behind an apache or lighttpd server (or X-Accel-Redirect behind nginx) to serve up files to authenticated users. This would allow you to have per-file permissions for users or groups, but it might be a bit more work than other solutions.

share|improve this answer
add comment

HTTPS WebDAV is perfect in your situation. By the other hand, you can use a free service (or pursache a VIP account) in DropBox. It can transfer files under SSL AES-256, and store the files in the cloud crypted.

share|improve this answer
add comment

Our company uses CrushFTP and like it a lot. It gives you FTP, HTTP and SSL options we just use the HTTPS. Its not really FTP when using the SSL, more like a website with an upload option. But I find SSL use better as some of our clients block FTP access, almost no one blocks SSL.

share|improve this answer
add comment

You could use FireFTP extension for Firefox. It supports all encryption / authentication methods. http://fireftp.mozdev.org/

share|improve this answer
add comment

Not sure what your budget is, but globalscape works pretty well. It also allows for upload/download via a web interface OR using a client.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.