FTP S3RVA! As In I Want To Set One Up!

[Einhander Sn0m4n]

Ok, I want to set up an FTP Server on my computer. I have tonz o filez on my hard drive and I'm feeling generous. I would like some recommendations on what's the best (fastest, most secure, etc) freeware FTP server program to use, how to set it up so it's secure, etc. In return I can PM the people who help me the FTP passcodes. Happy L33ching!

[BoredShirtless]

What OS are you running?

[Einhander Sn0m4n]

Win2k SP3.

[BoredShirtless]

Ok. First, you should know that FTP is for people who want their packets caught and examined. I'm guessing you're not one of them, so you'll want SFTP. I don't have any free recommendations for windows, but google does.

[aronkerkhof]

Seconded. With FTP its not a matter of if you'll be compromised, but when and how bad. The only thing you can do to prevent it is allow anonymous only access and lock your system's internet guest account down. Seems like that's not what you want to do, so you better get something that supports encryption. Security through obscurity isn't worth much, but might as well run it on a different (non-FTP) port while you're at it.

[phongn]

You can use OpenSSH via Cygwin for an SFTP server, but that takes some work and requires knowledge of working in a UNIX-esque environment. It is not particularly easy to set up. If you're just serving files, basic FTP is usually fine.

Cerberus FTP Server is on of the basic freeware FTP servers. Windows 2000 Professional comes with a stripped-down version of IIS5, but it is limited to ten concurrent connections and takes some work to properly secure.

Be aware that you may be in violation of your ISP's TOS if you open up a server.

[Pu-239]

You can use OpenSSH via Cygwin for an SFTP server, but that takes some work and requires knowledge of working in a UNIX-esque environment. It is not particularly easy to set up. If you're just serving files, basic FTP is usually fine.

It's not that bad... I already have it set up, and haven't edited a single file(well I did just for X11 forwarding but you don't need that). Then again, mine was preconfigured by Debian (but RH probably does that too with Cygwin), but the config file doesn't look that hard to understand. I've never configured multiple users under cygwin before, so I'm not sure about security once they are logged in (does it use NT ACLs to figure out permissions, if at all?). I would suggest to figure out how to make a new user with the home directory in the directory you want to upload files with, and make that the only directory they have write access to.

Um I think he's sharing... questionable... files, so he might need that encryption. But then there is the matter of transfering passwords securely to people without (gpg/pgp) keys. But before that there is the problem of ensuring those people aren't FBI agents. Etc, etc. Therefore one should not distribute warez online.

[phongn]

You can use OpenSSH via Cygwin for an SFTP server, but that takes some work and requires knowledge of working in a UNIX-esque environment. It is not particularly easy to set up. If you're just serving files, basic FTP is usually fine.

It's not that bad... I already have it set up, and haven't edited a single file(well I did just for X11 forwarding but you don't need that).

You're also running Linux and have experience with it. Don't mirror-image.

Then again, mine was preconfigured by Debian (but RH probably does that too with Cygwin), but the config file doesn't look that hard to understand.

For one, SFTP is not enabled by default under the Cygwin install.

I've never configured multiple users under cygwin before, so I'm not sure about security once they are logged in (does it use NT ACLs to figure out permissions, if at all?).

You use various Cygwin tools to create the passwd file. ACLs are enforced.

I would suggest to figure out how to make a new user with the home directory in the directory you want to upload files with, and make that the only directory they have write access to.

Something like that, yes.

Um I think he's sharing... questionable... files, so he might need that encryption. But then there is the matter of transfering passwords securely to people without (gpg/pgp) keys. But before that there is the problem of ensuring those people aren't FBI agents. Etc, etc. Therefore one should not distribute warez online.

Exactly. Or, for that matter, any copyrighted file that you aren't supposed to be sharing out. This thread will be locked posthaste if I find out any such activities will be done.