best FTP server for web server

[Rafnews]

Hi,

i'm looking for a good ftp server (free) which could work perfectly with a
web server.
basically i read a lot about proftpd but i have some problem with support.
Question stay unanswered :-(
so is there another good ftp server which could make a deal ?

the idea behind is to have a web server for testing purpose (in the testlab
for developers)

thank a lot.

[Jason Brown]

vsFTP

On Oct 4, 2010, at 7:55 AM, Alain Roger wrote:
> Hi,
>
> i'm looking for a good ftp server (free) which could work perfectly  
> with a web server.
> basically i read a lot about proftpd but i have some problem with  
> support. Question stay unanswered :-(
> so is there another good ftp server which could make a deal ?
>
> the idea behind is to have a web server for testing purpose (in the  
> testlab for developers)
>
> thank a lot.
>
> -- 
> Alain
>
> Windows 7 x64 / Fedora 13
> PostgreSQL 8.3.5 / MySQL 5
> Apache 2.2.16
> PHP 5.3.1
> C# 2005-2008
> -- 
> users mailing list
> [e-mail]
> To unsubscribe or change subscription options:
> https://admin.fedoraproject.org/mailman/listinfo/users
> Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

[Maxime Alarie]

I second that vsftp is   very good, and easy to install.

From: [e-mail]
[mailto:[e-mail]] On Behalf Of Jason Brown
Sent: 04 October 2010 08:00
To: Community support for Fedora users
Subject: Re: best FTP server for web server

vsFTP

On Oct 4, 2010, at 7:55 AM, Alain Roger wrote:

Hi,

i'm looking for a good ftp server (free) which could work perfectly with
a web server.
basically i read a lot about proftpd but i have some problem with
support. Question stay unanswered :-(
so is there another good ftp server which could make a deal ?

the idea behind is to have a web server for testing purpose (in the
testlab for developers)

thank a lot.

[Bruno Wolff III]

On Mon, Oct 04, 2010 at 13:55:46 +0200,
  Alain Roger  wrote:
> Hi,
>
> i'm looking for a good ftp server (free) which could work perfectly with a
> web server.
> basically i read a lot about proftpd but i have some problem with support.
> Question stay unanswered :-(
> so is there another good ftp server which could make a deal ?
>
> the idea behind is to have a web server for testing purpose (in the testlab
> for developers)
>
> thank a lot.

In general you want to avoid using ftp except for providing anonymous
downloads. For uploads, you should be using something that doesn't expose
passwords in network traffic. ssh is a better alternative for that.
'putty' is an ssh client available gratis for Windows, if that is a concern.

[Rick Stevens]

On 10/04/2010 10:16 AM, Bruno Wolff III wrote:
> On Mon, Oct 04, 2010 at 13:55:46 +0200,
>    Alain Roger  wrote:
> > Hi,
> >
> > i'm looking for a good ftp server (free) which could work perfectly with a
> > web server.
> > basically i read a lot about proftpd but i have some problem with support.
> > Question stay unanswered :-(
> > so is there another good ftp server which could make a deal ?
> >
> > the idea behind is to have a web server for testing purpose (in the testlab
> > for developers)
> >
> > thank a lot.
>
> In general you want to avoid using ftp except for providing anonymous
> downloads. For uploads, you should be using something that doesn't expose
> passwords in network traffic. ssh is a better alternative for that.
> 'putty' is an ssh client available gratis for Windows, if that is a concern.

Don't forget there is FTP-S (FTP over SSL).  vsftpd supports both FTP
and FTP-S.  Most reasonable FTP clients also support it (gftp,
kasablanca, etc.).
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, C2 Hosting          [e-mail] -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-         C program run. C program crash. C programmer quit.         -
----------------------------------------------------------------------

[PaulCartwright]

On Mon October 4 2010, Rick Stevens wrote:
> Don't forget there is FTP-S (FTP over SSL).  vsftpd supports both FTP
> and FTP-S.  Most reasonable FTP clients also support it (gftp,
> kasablanca, etc.).

what you mean is sftp.. for windows a great client is winscp. I used it for 
years, along with putty, which you can find anywhere, just google putty.exe .
both programs use the secure port 22.

[Maxime Alarie]

I second that sftp through winscp is excellent. I have been using it for years as well.  For remote connections, nothing beats the portability of putty.

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of Paul Cartwright
Sent: 04 October 2010 15:37
To: Community support for Fedora users
Subject: Re: best FTP server for web server

On Mon October 4 2010, Rick Stevens wrote:
> Don't forget there is FTP-S (FTP over SSL).  vsftpd supports both FTP
> and FTP-S.  Most reasonable FTP clients also support it (gftp,
> kasablanca, etc.).

what you mean is sftp.. for windows a great client is winscp. I used it for 
years, along with putty, which you can find anywhere, just google putty.exe .
both programs use the secure port 22.

[Sam Sharpe]

On 4 October 2010 20:36, Paul Cartwright  wrote:
> On Mon October 4 2010, Rick Stevens wrote:
> > Don't forget there is FTP-S (FTP over SSL).  vsftpd supports both FTP
> > and FTP-S.  Most reasonable FTP clients also support it (gftp,
> > kasablanca, etc.).
>
> what you mean is sftp.. for windows a great client is winscp. I used it for
> years, along with putty, which you can find anywhere, just google putty.exe .
> both programs use the secure port 22.

No... he means FTPS... like he said...

http://en.wikipedia.org/wiki/FTPS

It is a perfectly valid way of securing FTP and given that chrooting
SFTP is not trivial for a lot of use-cases, whereas chrooting FTP is a
very well known operation, FTPS actually has some advantages over
SFTP.

--
Sam

[Rick Stevens]

On 10/04/2010 12:36 PM, Paul Cartwright wrote:
> On Mon October 4 2010, Rick Stevens wrote:
> > Don't forget there is FTP-S (FTP over SSL).  vsftpd supports both FTP
> > and FTP-S.  Most reasonable FTP clients also support it (gftp,
> > kasablanca, etc.).
>
> what you mean is sftp.

No, FTP-S.  FTP over SSL using port 989 and 990.  sftp is a part of ssh
and uses it's encryption mechanisms.
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, C2 Hosting          [e-mail] -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-     Have you noticed that "human readable" configuration file      -
-          directives are beginning to resemble COBOL code?          -
----------------------------------------------------------------------

[PaulCartwright]

On Mon October 4 2010, Sam Sharpe wrote:
> > what you mean is sftp.. for windows a great client is winscp. I used it
> > for years, along with putty, which you can find anywhere, just google
> > putty.exe . both programs use the secure port 22.
>
> No... he means FTPS... like he said...
>
> http://en.wikipedia.org/wiki/FTPS

wow, I was not aware of ftps.. but it doesn't seem well known and how well is 
it supported? I clicked on one link for clients FireFTP firefox app, and it 
said it wasn't found.. seems like sftp is more widely used/accepted.. but you 
are right, sftp is NOT ftps !

[PaulCartwright]

On Mon October 4 2010, Rick Stevens wrote:
> > what you mean is sftp.
>
> No, FTP-S.  FTP over SSL using port 989 and 990.  sftp is a part of ssh
> and uses it's encryption mechanisms.

what I SHOULD have said is " what I 'THINK' you mean", and obviously I was 
wrong:)
so, is it better to ftp over SSL or sftp using ssh?

[Sam Sharpe]

On 4 October 2010 21:23, Paul Cartwright  wrote:
> On Mon October 4 2010, Rick Stevens wrote:
> > > what you mean is sftp.
> >
> > No, FTP-S.  FTP over SSL using port 989 and 990.  sftp is a part of ssh
> > and uses it's encryption mechanisms.
>
> what I SHOULD have said is " what I 'THINK' you mean", and obviously I was
> wrong:)
> so, is it better to ftp over SSL or sftp using ssh?

That depends on the circumstances - I personally prefer SFTP, because
most Linux machines already have an SSH server running.

However, there are complications, such as needing to chroot users
(historically hard with OpenSSH), needing to allow SFTP or SCP, but
not SSH, etc. This doesn't usually matter on a small friendly machine,
but if you are doing something like reselling webhosting to other
people, having lots of SSH users on your box might not be what you
want.

In those circumstances, offering (or mandating) FTPS is a good
compromise between security and usability. It still allows you to do a
lot of things that you would normally do in a mass-hosting
environment, like chrooting and blocking certain kinds of uploads -
just like you would with an FTP server.

To get this back on track, regarding what is a good FTP server, I have
to say I actually prefer ProFTPd - but then I don't need to rely on
their support.

- It uses an Apache-like syntax for configuration, so it is intuitive to me.
- It can integrate with MySQL for a user database.
- If offers .ftpaccess files - which are an incredibly powerful tool -
http://www.proftpd.org/localsite/Userguide/linked/x1021.html

Of course, this is only because glftpd is no longer maintained -
otherwise that would have been my favourite for old-time's sake:
http://www.glftpd.com/

--
Sam

[PaulCartwright]

On Mon October 4 2010, Sam Sharpe wrote:
> That depends on the circumstances - I personally prefer SFTP, because
> most Linux machines already have an SSH server running.
>
> However, there are complications, such as needing to chroot users
> (historically hard with OpenSSH), needing to allow SFTP or SCP, but
> not SSH, etc. This doesn't usually matter on a small friendly machine,
> but if you are doing something like reselling webhosting to other
> people, having lots of SSH users on your box might not be what you
> want.
>
> In those circumstances, offering (or mandating) FTPS is a good
> compromise between security and usability. It still allows you to do a
> lot of things that you would normally do in a mass-hosting
> environment, like chrooting and blocking certain kinds of uploads -
> just like you would with an FTP server.
>
> To get this back on track, regarding what is a good FTP server, I have
> to say I actually prefer ProFTPd - but then I don't need to rely on
> their support.

http://www.proftpd.org/goals.html

thanks for the info, so for my own personal home use, I'll stick with sftp:)
and maybe add proftpd !

[Michael Iatrou]

When the date was Monday 04 of October 2010, Alain Roger wrote:
> i'm looking for a good ftp server (free) which could work perfectly with
> a web server.

A very simple, secure and scalable FTP server is PureFTPd, you may want to 
take a look at it.

[Maxime Alarie]

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of Paul Cartwright
Sent: 04 October 2010 16:23
To: Community support for Fedora users
Subject: Re: best FTP server for web server

On Mon October 4 2010, Rick Stevens wrote:
> > what you mean is sftp.
>
> No, FTP-S.  FTP over SSL using port 989 and 990.  sftp is a part of ssh
> and uses it's encryption mechanisms.

what I SHOULD have said is " what I 'THINK' you mean", and obviously I was 
wrong:)
so, is it better to ftp over SSL or sftp using ssh?

[Rick Stevens]

On 10/06/2010 10:35 AM, Maxime Alarie wrote:
> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of Paul Cartwright
> Sent: 04 October 2010 16:23
> To: Community support for Fedora users
> Subject: Re: best FTP server for web server
>
> On Mon October 4 2010, Rick Stevens wrote:
> > > what you mean is sftp.
> >
> > No, FTP-S.  FTP over SSL using port 989 and 990.  sftp is a part of ssh
> > and uses it's encryption mechanisms.
>
> what I SHOULD have said is " what I 'THINK' you mean", and obviously I was
> wrong:)

"I never make mistakes.  I thought I did once, but I was wrong."  :-)
> so, is it better to ftp over SSL or sftp using ssh?

As others have said, chrooting FTPS is easier than chrooting ssh and its
kin.  sftp also infers ssh must be available as well.  I don't know if
that's true or not.  If it is and someone guesses your password, then
they get a shell via ssh.  Depends on how paranoid you are.

FTPS has the ability to use three different encryption things: no
encryption, encryption of just the control channel or encryption of
both control and data connections.  vsftpd allows you to run both 
regular FTP and FTPS using the same daemon and there's no possibilty
of an outsider getting a shell.

It's up to you.  We use sftp for most things here, but I've had a lot
of clients in the past want FTP/FTPS.  As for the paranoia thing:

"Just because I'm paranoid doesn't mean they AREN'T out to get me!"
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, C2 Hosting          [e-mail] -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-     Try to look unimportant.  The bad guys may be low on ammo.     -
----------------------------------------------------------------------

[PaulCartwright]

On Wed October 6 2010, Rick Stevens wrote:
> > so, is it better to ftp over SSL or sftp using ssh?
>
> As others have said, chrooting FTPS is easier than chrooting ssh and its
> kin.  sftp also infers ssh must be available as well.  I don't know if
> that's true or not.  If it is and someone guesses your password, then
> they get a shell via ssh.  Depends on how paranoid you are.

I'm... a small home user, and not at all familiar with chrooting, should I be 
using it too? as for the guessing my password, that is a good point. Though I 
do not do that as root, still, that would allow access to my system.
> FTPS has the ability to use three different encryption things: no
> encryption, encryption of just the control channel or encryption of
> both control and data connections.  vsftpd allows you to run both
> regular FTP and FTPS using the same daemon and there's no possibilty
> of an outsider getting a shell.

vsftpd, I'll have to check that out. thanks for the tips & info, always good 
to learn new useful apps..
> It's up to you.  We use sftp for most things here, but I've had a lot
> of clients in the past want FTP/FTPS.  As for the paranoia thing:
>
> "Just because I'm paranoid doesn't mean they AREN'T out to get me!"

that's exactly how I think when I'm out on my motorcycle:)

[Rick Stevens]

On 10/06/2010 05:33 PM, Paul Cartwright wrote:
> On Wed October 6 2010, Rick Stevens wrote:
> > > so, is it better to ftp over SSL or sftp using ssh?
> >
> > As others have said, chrooting FTPS is easier than chrooting ssh and its
> > kin.  sftp also infers ssh must be available as well.  I don't know if
> > that's true or not.  If it is and someone guesses your password, then
> > they get a shell via ssh.  Depends on how paranoid you are.
>
> I'm... a small home user, and not at all familiar with chrooting, should I be
> using it too? as for the guessing my password, that is a good point. Though I
> do not do that as root, still, that would allow access to my system.

It depends on how secure you wish to be.  If your site is going to get a
lot of traffic or you're going to have a lot of different people
uploading to you, yes, I'd consider a chroot environment (a.k.a. chroot
jail).  The details of a chroot jail are available elsewhere and I
won't go into the details here.
> > FTPS has the ability to use three different encryption things: no
> > encryption, encryption of just the control channel or encryption of
> > both control and data connections.  vsftpd allows you to run both
> > regular FTP and FTPS using the same daemon and there's no possibilty
> > of an outsider getting a shell.
>
> vsftpd, I'll have to check that out. thanks for the tips&  info, always good
> to learn new useful apps..
> > It's up to you.  We use sftp for most things here, but I've had a lot
> > of clients in the past want FTP/FTPS.  As for the paranoia thing:
> >
> > "Just because I'm paranoid doesn't mean they AREN'T out to get me!"
>
> that's exactly how I think when I'm out on my motorcycle:)

----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, C2 Hosting          [e-mail] -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-           Give me ambiguity or give me something else!             -
----------------------------------------------------------------------

[Bill Davidsen]

Paul Cartwright wrote:
> On Mon October 4 2010, Rick Stevens wrote:
> > > what you mean is sftp.
> >
> > No, FTP-S.  FTP over SSL using port 989 and 990.  sftp is a part of ssh
> > and uses it's encryption mechanisms.
>
> what I SHOULD have said is " what I 'THINK' you mean", and obviously I was
> wrong:)
> so, is it better to ftp over SSL or sftp using ssh?

One advantage of sftp is that you don't need passwords. You can give the user 
the public key, and use the authorized hosts file for control.

This URL points to the solution to run chroot sftp: http://goo.gl/KuKl

Linux sftp, Win putty, and Mac (sftp?) work with keys. I think this is probably 
the safest way to go, dropping the user chroot into public_html.