FTP Wrapper

Author
Discussion

PetrolTed

Original Poster:

34,439 posts

305 months

Tuesday 21st October 2003
quotequote all
Does anyone know of a tool or software that I can use to give limited access to an FTP site.

I have an FTP site which is password protected. I don't want to give out that password but I do want to give selected people the ability to upload files.

Any suggestions?

JamieBeeston

9,294 posts

267 months

Tuesday 21st October 2003
quotequote all
firewall it to peoples IPs

Would be about the only decent option.

depending on what program your using (assuming its doze given your preference)

IIS lets you accept / deny ips for services. Ditto a third party firewall, like zonealarm Pro.

If people are on dynamic IPS, it becomes alot harder.

you could move ftp to a non standard port (easily done) but doesnt stop the determined finding it out.

JamieBeeston

9,294 posts

267 months

Tuesday 21st October 2003
quotequote all
or .. aah. did i misunderstand.

you have an ftp account, but you dont want people to have the password at all for the account, but still upload to it..

if thats the case (assuming its ftp for an account which you cant setup sub accounts on, or change password) couldnt you implement some PHP / ASP upload ability via a script and webpage.

OR, you could setup a FTP Bouncer, that will autoconnect people to the remote host and supply the l/p for them.. but this is more Nix area.. and not anywhere near secure.

Without knowing more of the problem, its hard to know the scope of the answers that can be provided :P

tja

1,175 posts

256 months

Tuesday 21st October 2003
quotequote all
Can you not add more accounts to the ftp server? These accounts could then have certain privileges (upload/download/overwrite/etc)

What OS does the FTP server run? And do you have root/admin access to that machine?

PetrolTed

Original Poster:

34,439 posts

305 months

Tuesday 21st October 2003
quotequote all
Ok, I'll elaborate.

Easynet are providing hosting for PistonHeads.tv videos. I've got an FTP account into the webspace they've provided me. It's a simple account, I have limited admin control.

I don't want to expose the password for that account, but I do want to be able to provide a means of someone uploading a video to it.

tja

1,175 posts

256 months

Tuesday 21st October 2003
quotequote all
How about a php (or similar in asp) page that asks for a username/password and allows the user to browse (locally) to the file to be uploaded. This username/password could be security checked against a secure file (somewhere outside the publicly available web space) before uploading to the site using your master user/pass (which would be secure as it would be held in the php/asp and unavailable to the public). I'm sure I've seen freely available scripts that do something similar. Have a look at www.cgi-resources.com/

JamieBeeston

9,294 posts

267 months

Tuesday 21st October 2003
quotequote all
PetrolTed said:
Ok, I'll elaborate.

Easynet are providing hosting for PistonHeads.tv videos. I've got an FTP account into the webspace they've provided me. It's a simple account, I have limited admin control.

I don't want to expose the password for that account, but I do want to be able to provide a means of someone uploading a video to it.


Joust is a nice bwoi

Sorta rules out the firewall option then.

Only real option is an upload script now, in php / asp.

Simple enough to write, plenty of freeware ones available. Not exactly uber secure, but better than letting the password out.

Only other option is asking them to setup an Anon ftp server on there, with upload only permissions.

tja

1,175 posts

256 months

xsaravtr

801 posts

264 months

Tuesday 21st October 2003
quotequote all
Have a look for ASPUpload. It a component you install on the server. It should come with sample scripts that comprise of a HTML form and associated asp script that uploads the file. This can be any file not just a video and you will be able to limit the size. I've used it on a site for uploading images, works a treat!!!

I'll have a look for the url and re-post...

Doh!!! www.aspupload.com

Check your hosting package, it might come with something similar. We originally had this version preinstalled on shared hosting, but managed to find a free program when we got a dedicated server. Will try and find this one, got url at office.

>> Edited by xsaravtr on Tuesday 21st October 19:53

outlaw

1,893 posts

268 months

Tuesday 21st October 2003
quotequote all
PetrolTed said:
Does anyone know of a tool or software that I can use to give limited access to an FTP site.

I have an FTP site which is password protected. I don't want to give out that password but I do want to give selected people the ability to upload files.

Any suggestions?


I take it your talking about uploading at the host server.

if so then the a cgi pearl script witll do the job like others have said.

not running a ftp some else where your self
if you are just geta desent ftp demon and set up a diferent acount with only upload acssse.

ps dont leav the anonymous access

squirrelz

1,186 posts

273 months

Wednesday 22nd October 2003
quotequote all
Ted, you can't just supply a wrapper around ftp with the userid/password concealed in it because the ftp protocol sends the userid and password in cleartext, and all someone would have to do to find it is run a packet sniffer on their network connection to see them.

apeebles

267 posts

286 months

Wednesday 22nd October 2003
quotequote all
Ted,

Give Easily tech support a call and see if they can create another account with only upload priv. That would be the easiest non techie solution. Easy to test.

PetrolTed

Original Poster:

34,439 posts

305 months

Wednesday 22nd October 2003
quotequote all
Nice bit of lateral thinking that one - cheers!

Graham

16,368 posts

286 months

Wednesday 22nd October 2003
quotequote all
if you want to go a bit clever i'd go the php route.

wehave one of our apps that lets people create db entries and then select upload to add an image. the upload routing displays the normal file browser, and when the file is uploaded the script has full control about where it goes and its nameing. usefull if you want stuff loaded into an approval area before going live

G

xsaravtr

801 posts

264 months

Wednesday 22nd October 2003
quotequote all
Ted,

Found it...

www.aspsmart.com/aspSmartUpload/

Good little script, best of all its FREE!!!

PetrolTed

Original Poster:

34,439 posts

305 months

Wednesday 22nd October 2003
quotequote all
Thanks, that's similar to what I use for the picture uploads on the adverts. I don't have the rights to install components on the server in question though.

xsaravtr

801 posts

264 months

Wednesday 22nd October 2003
quotequote all
PetrolTed said:
Thanks, that's similar to what I use for the picture uploads on the adverts. I don't have the rights to install components on the server in question though.


Bummer... Will have a think and see if there are any other ways to do it, ASP or otherwise... I assume you have CGI support?

tja

1,175 posts

256 months

Wednesday 22nd October 2003
quotequote all
No components, just an asp file:
www.freeaspupload.net

PetrolTed

Original Poster:

34,439 posts

305 months

Wednesday 22nd October 2003
quotequote all
Had a damn good search and can't find anything appropriate.

Might just be easier to manage it on my server and transfer the files across.

davidd

6,491 posts

286 months

Thursday 23rd October 2003
quotequote all
PetrolTed said:
Had a damn good search and can't find anything appropriate.

Might just be easier to manage it on my server and transfer the files across.


Which might be a good idea as it will allow you to vet everything before it goes live.

D.