8

We need to securely serve files to our clients. We want the transport to be encrypted, users should require user/password and they should be able to access their files through the web, ftp/sftp and curl.

The obvious idea is to use openssh and its sftp server. However, I don't see how to provide a web interface to the sftp server.

In other words, while most clients will use automated scripts to get their files, they may have an occasional need to get the files manually from a web page (which means they need to manually type in their user/password)

Any ideas?

edit: Sorry, forgot to mention that we intend to serve these files off a linux server

9 Answers 9

4

Having "sftp://" links will indeed require you have a sftp-capable client registered to handle the sftp UNC and will also require a re-login unless you provide the username/password in the unc... i.e. sftp://user:[email protected]/path/file. This really defeats the purpose of having a separate sftp server from the http server.

Why not simply establish a HTTPS session with whatever authentication method you choose to use, and let the http server dish out the files? If you're using apache, you can allow directory browsing, and it will auto-generate the directory listing from a specific directory... and you can make the sftp pull from the same directory. (if you wish to use both)

If you are stuck on using sftp... don't forget to restrict user logins using ssh to ONLY allow sftp and/or scp... or you will be leaving yourself open to a big security hole.

3
  • This sounds interesting...but some things aren't clear to me. Can you point me to some material that shows how to do this? --developer trying to do admin stuff :)
    – user23398
    Aug 30, 2010 at 17:57
  • For read-only access HTTPS is fine. But if you want writable access, what would be the best way to achieve this? I don't see anything better than webdav, despite its reputation as archaic. Jun 5, 2018 at 21:07
  • https really isn't meant for file-transfer. webdav added some additional non-standard http methods in order to add some additional file-transfer functionality, but doing such is highly-frowned upon. If you're seriously wanting to transfer files back & forth... stick with a file-transfer program such as firezilla. It is compatible with sftp/scp/ftp/etc... and free. On the server, it is highly recommended to setup "jails" for security purposes, and to prevent users from gaining access to stuff they're not supposed to have.
    – TheCompWiz
    Jun 7, 2018 at 17:48
2

Have you considered the File Manager inside Usermin? You can serve Usermin over HTTPS and that will be secure, and while you didn't mention what OS you're using, Webmin/Usermin are available for a wide variety of systems.

3
  • Looks like usermin/webmin is for internal users, rather than external clients who should never see options to change passwords, add/remove users, etc. Did I misread the usermin page?
    – user23398
    Aug 30, 2010 at 17:28
  • 1
    It does look like UserMin is meant for what you say, but @Josh was specifically calling out the File Manager component of it, which should do what you want. It does upload and download, according to the docs. Just make sure the users have no rights to anything you don't want them to.
    – mfinni
    Aug 30, 2010 at 17:46
  • @mfinni that's correct. I wasn't aware of any other web based sftp solutions so I figured I'd suggest usermin. There may be better alternatives out there that I'm not familiar with.
    – Josh
    Aug 30, 2010 at 18:41
2

Why do is there a requirement for sftp? Have you considered just setting up an webdav? With webdav users will be able to but put and get files directly via HTTP(S).

2

Fire FTP plugin (only) for Firefox web browser.

2

Look at using AnyClient. It's a free web based service that allows users to connect to FTP/S, SFTP, WebDAV and Amazon S3 services from a webpage without having to install any client software.

http://www.jscape.com/products/file-transfer-clients/anyclient/

1

Late to the party but, www.monstaftp.com is a web-based FTP/SFTP/SCP client that's free to use (but has upgrades.)

(Disclaimer: I'm involved with this project.)

0

You'll want them to login over HTTPS and provide download links via https:// and change the content-type so the files don't load in the browser window.

You may be able to provide sftp:// links but they will only work if the users have a properly configured client and will likely require that they login again.

2
  • I'm trying to avoid the need to 'provide download links' myself. I was hoping for a simple web front-end to an sftp server that does this for me.
    – user23398
    Aug 30, 2010 at 17:28
  • If you turn on "Directory Indexing" on the HTTP server the links are generated automatically. Be careful because it's easy to expose files you didn't intend to put online (but that happen to be co-located with those you did) with this method.
    – Chris Nava
    Mar 14, 2011 at 5:05
0

maybe this will help ?: http://sftp.thinfile.com/sftp/

0

You could always provide a short tutorial on how to download and use an SFTP client, for those occasional uses.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .