User Permissions for a Public FTP

Question

I'm a newbie with FTP/User permissions. We are a magazine, and we have an ad server where all the advertisers place their ads each month. As of now, the primary user, advertiser, has all read/write/execute permissions, so any advertiser can get/delete anyone else's files.

What I'd like to do is set it so there is the admin (me), who has read/write/execute permission, and the subuser, advertiser, who can only upload files onto the site, with no permission to delete (or even view, if possible) anyone else's files.

Answer 1

Depends on the operating system of the server and what ftp server software you are using. You'll probably find *nix operating systems to be a bit more flexible on the permissions.

If you want it to be truly secure, give each client their own login with their own unique folder.

Answer 2

Hey... you aren't a customer of ours, are you? We just dealt with this exact problem...

Assuming you're on a Unixish system (based on "read/write/execute permissions"):

1. Setup a base directory, say /home/ftpuploads, and setfacl -d user:<you>:rwX /home/ftpuploads
2. Create individual users with home directories of /home/ftpuploads/<username>, with appropriate shell, ftpd config, etc so they can only FTP, and are chrooted to their home directory.
3. ...
4. PROFIT!

Answer 3

You can set the umask for the FTP server so that files are created so that only the appropriate user and group can see or do anything to the files. Then make sure each user has a separate username and group. (This will prevent anyone from reading or modifying other's content, even within the same directory)

Then as the administrator you can make yourself a member of all of their groups.

My suggestion would be that you as an administrator access the content via NFS or Samba - or even sftp, not FTP. FTP passwords are sent in the clear, and if this is a public server, can be easily sniffed. We have a setup where our public FTP server is mounted as a Network Drive on computers on our domain, and managed via Active Directory credentials.

Answer 4

We have used CrushFTP on a Windows server for some time and it works great. It supports Unix and Mac as well. Allows for secure file transfers and very granular control of who can do what and when. It will alert when a file is uploaded or downloaded and has great features to stop any kind of attack.

Support is fantastic and there are many other features. It is quick and easy to install and very reasonably priced.

There is a free eval as well. A new version we just released which we have not tested as yet.

http://www.crushftp.com/