Q As a design agency receiving artwork and other raw material by email and through the post on CD and DVD, we were considering teaching our clients to upload material to us on to a co-located server running Fedora. At first we were considering implementing a web-based application. However, after much deliberation we saw the light and are now considering using FTP. Our primary concern is security: we don't want to give our clients access to other clients' uploads. However, the sysadmin who originally provisioned the server advised us to upload our website over SSH rather than FTP, claiming that SSH is much more secure. What is your opinion?
A Fedora ships with Vsftpd, which is a robust FTP server that makes chrooting users a breeze. Chrooting means that the user will be tied down to their home directory and no other. To enable FTP chrooting, uncomment the following two lines from /etc/vsftpd/vsftpd.conf:
chroot_list_enable=YES chroot_list_file=/etc/vsftpd.chroot_list
The list of FTP chrooted files should be in the file /etc/vsftpd.chroot_list. Also, as you would not want to give FTP users shell access to your server, /bin/false should be specified as the shell when creating the users:
# useradd -s /bin/false -m -k /dev/null someuser
If you're adamant about using SSH rather than FTP, you can install scponly to enable users to scp or sftp into the server without having the right to interactively ssh into the server. The scponly project lives at www.sublimation.org/scponly. Installation is well documented in the Install file included in the tarball. Scponly users can also be chrooted, making the installation marginallymore complex.