Summary: Secure Upload on no-shell server

Dear LinuxManagers,

Thanks to all the kind souls who responded.  I hope I haven't missed any 
names:

	Dirk Dettmering
	Chupacabra
	Ethan Alpert
	Martin Schmitt
	Rob Rankin
	Mark Neill
	Chris Scheller
	Chris de Vidal
	Jeff Woods

My question gave a lot of opportunity for decent discussion of the 
various methods we've alreday rejected, and Jeff was especially good for 
bringing out more ideas based on the discussion.  Here's a sampling of 
the suggestions:

> Martin Schmitt wrote:
> 
>>>RSync:
>>> - It seems to need ssh for secure xfer.  We do sftp/scp.
>> 
>> Scponly has support for rsync: http://www.sublimation.org/scponly

This is potentially the best suggestion yet.  Massive config changes 
will toss my admin into fits, but it's got such a great payoff, potentially.

Since we site-owners need to develop locally and push changes to the 
no-shell server - currently via authed clear ftp, ugh - this kind of 
solution seems to allow us a better option for one-command updating or 
synchronization of the entire site.

The final challenge is to package something to send to my admin - a busy 
  guy - so that he can see it go.  The more automatic an install it can 
be, the more quickly it gets rolled out.

> Rob Rankin wrote:
>> What about plain vanilla FTP over SSL?
>> 
>> glftpd I know for one supports it.  I have no idea which clients support
>> it though.
>> 
>> The beauty of glftpd is that it has nothing to do with the OS users /
>> shell users (by design).  Any glftpd users are created solely by glftpd
>> and have no access to the OS / shell.
>> 
>> Cheers,
>> Rob.

My favourite ftpd also supports SSL, as do a number of them:  wu, pro, 
vs, apparently gl, and (below) gsi.  Have some links:

http://www.wu-ftpd.org/
http://www.proftpd.net/
http://vsftpd.beasts.org/
http://www.glftpd.org/

Incidentally, messages to the VSFTPd maintainer during recent upgrade 
work went unanswered.  I know it's got to have 
throttling/acl/reporting/email features, but I can't find them.

Use your favourite apt mirror to grab your favourite.  SSL Cert setup 
seems to be simple in most cases, and all you need to do is find a 
client:    (hail google)

http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html

> Chris Scheller wrote:
> 
>> not entire sure what you are driving at but webdav over ssl is quite
>> handy. can be mounted directly from windows as a webfolder, bring in
>> all the drap and drop goodness users like. and davfs for linux to
>> mount the shares. checkout http://www.webdav.org/ for more info. not
>> sure if that is what you want, but it is quite handy.

Webdav's definitely grown up, and this is really interesting.

> Mark Neill wrote:
>>>>That being said, I would like to put in a vote to possibly reconsider the 
>>>>"no-shell" rule in favor of a "hosted users get rbash".  You can set up 
>>>>the bash profiles to allow access to a small subset of commands (say, copy 
>>>>vi/pico/etc to /usr/local/hosted-users/bin), and rbash users are unable to 
>>>>invoke other shells, source in files, alter their PATH, or do much of 
>>>>anything outside of what you explicitly give the account access to.

>>>>There are herds of Windows SFTP clients, personally I like: 
>>>>http://winscp.sourceforge.net (use the version...oh, new NEW version, I'm 
>>>>running v2.2, need to go play with v3.4.2 now :) ).  And UNIX geeks will 
>>>>just use scp/sftp from the command line :)

Mark's suggestion was a really good one as well.  There's some concern 
about a swallow-the-fly kind of situation with the security, but he's 
convinced me that it's possible and he's proven very willing to help. 
Kudos.

He's also come out in defense of user shells, a noble cause, with an 
excellent goal, and one with a few challenges of its own in light of the 
latest local exploit.  The rbash would be *crucial* here, to prevent the 
excution of designed binaries or tools that exploit that root-hole. 
This idea is my #2, and I'm confident that Mark's warming up in the 
'bull-pen' to assist me if I press my admin for this route.

> Dirk Dettmering wrote:
> 
>>> features.  As it is, we're using rssh to provide scp and sftp access but
>>
>> One possible solution could be: scp (with WinSCP2 as a GUI-Client for
>> windows users) together with the rssh (restricted secure shell, search
>> freshmeat for it). That's the way I give my users access to their
>> area. 

The WinSCP2 will be a good recommendation.  At the very least, it's an 
optoin besides cleartext auth for those of us continuing to update our 
sites remotely, if we have to do it on win machines, but see below.

Dirk's not the first to recommend WinSCP.

> Ethan Alpert wrote:
> 
>> Another thing I thought about and may or may not be more than you want to
>> look into is the Globus Security Infrastructure (GSI) and gsiftp they've
>> implemented. http://globus.org

This one will take some sit-down reading, but it may be worthwhile. 
GSIftpd, by itself, may be no better than my current favourite 
fully-featured ftp file-flinger, but I'm prepared to be surprised when I 
do sit down.


AT THE END OF THE DAY
---------------------

When the dust settles, I'm left with some good conversation, especially 
with Jeff, Chris and Mark, and some very good ideas.  I'm going to try 
out the scponly solution first, and see how much config work I need to 
push on my ornery admin.  Depending on how that goes, it may be just 
ftps that does it.

Two factors come into play here:  the mainly-windows composition of the 
site-owners and users that access this linux server, and the workload on 
my admin.  Solutions that fit both windows and linux are better for the 
userbase as a whole.  Also, how well I can package things for easy 
inspection and installation by my busy admin, before he installs on his 
test server and then production server, is a major factor.  A procedure 
is nice, and something he'll put into his 'when I get time' queue, but a 
package can be installed more easily after inspection of its bits, and 
tested, etc.

An extra large thanks for the folks that took time out of their busy day 
to answer my question, my apologies that my question wasn't worded as 
well as it should have been, and thanks to MrBill and all the list 
members that make this forum a resource.

  - bishop
Return-Path: <[email protected]>
Received: from ithaca.platypus.bc.ca (h163-0-141-64.wedohosting.com
  [64.141.0.163] (may be forged)) by fishy.myvnc.com (8.12.8/8.12.8)
  with ESMTP id hB10uIcZ004616 for <[email protected]>; Sun, 30 Nov
  2003 16:56:18 -0800
Received: from platypus.bc.ca (h24-68-22-9.gv.shawcable.net
  [24.68.22.9]) (authenticated bits=0) by ithaca.platypus.bc.ca
  (8.12.8/8.12.8) with ESMTP id hB10uFYb021802 (version=TLSv1/SSLv3
  cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 30 Nov 2003
  16:56:16 -0800
Message-ID: <[email protected]>
Date: Sun, 30 Nov 2003 16:55:48 -0800
From: bishop <[email protected]>
User-Agent: Mozilla/5.0 (Windows; U; Win98; en-GB; rv:1.5)
  Gecko/20031007
X-Accept-Language: en-ca, en, en-us
MIME-Version: 1.0
To: linuxmanagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
Subject: Secure Upload on no-shell server
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
x-foo: /home/bishop/Mail/arc-sent/2003/sent-200311

Dear LinuxManagers,

I think I've forgotten the number of times I've almost asked a question. 
  This one is finally an issue that's barely time-critical enough to 
warrant a post.  My server admin needs a secure ftp-type replacement for 
users who do not have shell access, so that we all can edit our sites 
without a web-form.

Ideally, we're looking for something that's easy enough that maybe even 
Joe SixPack will be able to use it with some coaching.  Graphical for 
windows would be a bonus, but ideally something with a textUI that can 
be launched periodically by windows 98 people and/or cronned on unix 
would be completely ideal.  Here's the catch:

Users do not have ssh access; they have SCP and SFTP.  That, in itself, 
is a surprisingly common goal that's been surprisingly hard to provide 
without implementing some flawed solution requiring its own odd 
workarounds.  We'd be willing to ditch sftp/scp for something else 
that's also moderately secure and just as simple, if it gets us better 
features.  As it is, we're using rssh to provide scp and sftp access but 
no ssh;  this frees us from worry about securing .bashrc files and other 
swallow-the-bird-to-catch-the-spider-who-ate-the-fly carry-on nonsense 
that quickly escalates into something unmaintainable.  :-)

We've already looked at a few solutions that didn't make the cut, based 
either on missing features or us not seeing the features we need:

RSync:
  - It seems to need ssh for secure xfer.  We do sftp/scp.

Unison:
  - You know your niches.
  - It seems to need ssh for secure xfer.

PHP Upload + JS FileMan in https on server:
  - No shell/cron mechanism.

bare SCP:
  - It has no Update mechanism, so it wants to re-send the entire
    site.

SFTP+mirror.pl:
  - Mirror.pl hated using sftp.  I think it was the directory listing
    or a similar feature missing or different behaviour with sftp.

TCP over SSH tunnel:
  - If you weren't a minor, you'd be shot for such abuse of TCP.
  - Falls over at moderate link saturation.
  - It also seems to require ssh-not-scp on the server.

TCP app over IPSEC:
  - come set it up (IPSec has proved non-trivial to set up;  hours of
    personal attention would be required).
  - unusable for WIN98 endpoints
  - otherwise, very cool

TCP app over openVPN
  - unusable for win98 endpoints (which are 90%+ of the people)

Any suggestions you have, even if they involve one of the rejected ones, 
would be appreciated.  As always and of course, I'll summarise (please 
harass me in 7 days should I forget) and my apologies if (hail murphy) 
someone has posted this very question within the last 7 days.

Lastly and Mostly, thanks for your time.

  - bishop

-- 
_______________________________________________
LinuxManagers mailing list - http://www.linuxmanagers.org
submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers