up vote 1 down vote favorite
1

Back in the old days, we could easily setup an ftp server with anonymous upload access whereas once the file was uploaded, the user couldn't see, delete, or modify the files they have uploaded.

I'm trying to set something like that up now in CentOS 6.2 or ubuntu 11.10, but we are transferring sensitive data that needs to be over an sftp/scp/ftps connection. I've tried using a chrooted sftp connection, however due to the way linux folder and file permissions work, if a user has write access to a folder they can delete a file in that folder no matter what.

Has anyone else setup a similar environment? I'd like for them to have a username or username/password combination that would log so we would know who uploaded what file, however once the file is uploaded they should no longer have access to remove or modify the file.

Thanks!

share|improve this question
up vote 0 down vote accepted

Never used it but ProFTPD has a sftp module. See http://www.proftpd.org/docs/contrib/mod_sftp.html#Usage which shows how you can limit it just like FTP (e.g., Limit DELE clauses to prevent deletions).

share|improve this answer
    
I originally considered proftpd, since it is such a malleable software product, but I thought I'd post here first to see if anyone else had set something up similar to see their results. I'll probably put this together today, and if it works out how I'd like I'll post a response with my results. Thanks for your help. – Mycah Mar 7 '12 at 16:28
    
This seems to work. I'm able to have an sftp server now so that when a user logs in, they don't see anything yet they can upload. sftp client in openssh kind of freaks out, but winscp works if you turn off resume. – Mycah Mar 7 '12 at 22:21
up vote 0 down vote

*Edit: I was writing baloney, as I hadn't read the question properly, this post had a field-operation idiotectomy, now it hopefully relates to the question somewhat .. ;-)

I think the recommended steps would be to use some traditional port 21 active/passive type ftp server that provides an SSL/TLS layer on top of the standard old school chroot'ed user ftp dropbox.

vsftpd is example of an ftp server which can be configured to use ssl and supports low level configuration of user permissions allowing you to create a authenticated dropbox style ftp system.

I would create separate users for this ftp project, with shell /sbin/nologin and add them to a text file, which can be passed to vsftpd as permitted local users.

you can also set the following options to restrict the users similar to your requirements

 #If set to NO, all directory list commands will give permission denied.   
 dirlist_enable NO  
 #If set to NO, all download requests will give permission denied.   
 download_enable NO  
 #If activated, all non-anonymous logins are forced to use a secure SSL connection  
 force_local_data_ssl YES  
 #If activated, all non-anonymous logins are forced to use a secure SSL  
 force_local_logins_ssl YES  
 #obfusciate, probably not needed given directory listing restrictions  
 hide_ids YES  
 # allow users with no shell to access ftp, but you have to disable these users via the   
 #vsftpd local permitted users list, not via /etc/passwd  
 check_shell NO

You will also need also to use some configurations to enforce the write-only, no delete requirement, this probably requires you to specify a list of appropriate commands using teh cmds_allowed and cmds_denied configuration options.

There is a list of ftp commands with a brief explanation here;, you might have to try some trial and error, as these are not field tested...

 #
 chmod_enable No
 #something like the following...
 #cmds_allowed=PASV,RETR,QUIT,PUT,USER,PORT,SYST,QUIT,STOR,CWD,PWD
 #add any other commands that allow READ or DELETE, or rename, etc.
 cmds_denied=DELE,GET,LIST,MDTM,MKD,NLST,RETR,RMD,RNFR,RNTO,APPE

there are various docs available, which discuss possible vsftpd settings here - http://viki.brainsware.org/?en/cmds_allowed

You can completely customize the commands available from the full list here; https://calomel.org/vsftpd.html

explanation of commands is here; http://www.nsftools.com/tips/RawFTP.htm

share|improve this answer
    
How do you prevent deletion of files? – Mark Wagner Mar 7 '12 at 3:09
    
I would try to strip off their own user file permissions off the uploaded files using some combination of file_open_mode and local_umask – Tom H Mar 7 '12 at 3:24
    
there might be an option for limited which commands for each user, to prevent the use of DELE. haha, maybe proftpd is the best bet as @Mark Wagner suggested. this post has some pointers for the anon version of the strategy – Tom H Mar 7 '12 at 3:26
    
Apparently if you have write access to a folder you can delete any file no matter what permissions or who the owner is. I discovered that researching for this project, and it was quite a surprise. I stripped permissions and set the owner as root and a user could still remove it because they had write access to the folder it was in. – Mycah Mar 7 '12 at 22:19
    
@Mycah I originally offered vsftpd as a possible solution because I had misunderstood the question and there is a common public ftp dropbox config for vsftpd, it sounds like @MarkWagner's suggestion of proftpd would be the way forward.... However with vsftpd you can use chown_uploads=root cmds_denied=DELE,RNFR,RNTO,LIST,NLST,RETR chmod_enable=No and that would appear to severely limit what the logged in user can do. – Tom H Mar 8 '12 at 22:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.