Baslinux mailing list

[Lee Forrest <lforrestster AT gmail.com>]

On Tue, Feb 27, 2007 at 09:32:04PM +0000, Lee Forrest wrote:
> On Wed, Feb 28, 2007 at 12:06:41PM +1000, Ron Clarke wrote:

What I want here is just a simple, secure, anonymous FTP server
that I can bring up when someone wants to download files that
I have here, or to send me files. No messing with logins or
passwords.

Here's what I have now:

I downloaded the README and tarball and installed the
pure-ftpd package, both found here:

http://www.ausreg.com/bl/bl3/ 

The I created a user account for "ftp" with adduser, with no
password (just hit Enter/Return twice and ignore the complaint).
This also created /home/ftp. I Changed the shell in /etc/passwd
from /bin/sh to /bin/true.

When I want to bring it up I run the following command:

-------------------------------------------------------

/usr/bin/pure-ftpd -b -B -c 10 -C 2 -e -K -r -R

--------------------------------------------------------

(These, and other options, are found in the README and the
manpage.)

-b    

Be broken. Turns on some  compatibility  hacks  for
shoddy  clients, and for broken Netfilter gateways.

(for windows users)
       
-B     

Start the standalone server in  background  (daemo
nize).                               
       
-c clients [10]

Allow a maximum of clients to be connected. clients must be at
least 1, and if you combine it with -p it will be forced down to
half the number of ports specified by -p. If more than clients
are connected, new clients are rejected at once, even clients
wishing to upload, or to log in as normal users. Therefore, it is
advisable to use -m as primary overload protection. The default
value is 50.
       
(paranoia)

-C max connection per ip [2]            

Limit the number of simultanous connections coming from the same
IP address. This is yet another very effective way to prevent
stupid denial of services and bandwidth starvation by a single
user. It works only when the server is launched in stan dalone
mode (if you use a super-server, it is sup posed to do that).
If the server is launched with -C 2 , it doesn't mean that the
total number of connection is limited to 2. But the same client,
coming from the same machine (or at least the same IP), can't
have more than two simultaneous connec tions. This features needs
some memory to track IP addresses, but it's recommended to use
it.

(paranoia)

-e     

Only allow anonymous users to log in.

 -K     

Allow users to resume and upload files, but NOT to delete them.  
Directories can be removed, but only if they are empty.          
         
-r     

Never overwrite existing files.  Uploading  a  file
whoose  name  already  exists  cause  an  automatic                           
      
rename. Files are called xyz.1, xyz.2, xyz.3,  etc.                           
      
              
-R     

Disallow users (even non-anonymous ones) usage of the CHMOD
command. On hosting services, it may prevent newbies from doing
mistakes, like setting bad permissions on their home directory.
Only root can use CHMOD when this switch is enabled.

(paranoia)

----------------------------------------------------

Seem to be working just fine, though it hasn't been tested. I
see this with ps when I run the command:

267 root        516 S   pure-ftpd (SERVER) 

It's logging to /var/log/syslog.

To kill it I do:

kill -9 267

--------------------------------------------------------

That look okay, Ron?

Right now, it's BAO, but I'm working on that. You can, with a
client app that updates a remote DNS server with your current IP,
get a static IP for free on the web (I think it's dyndns.org, and
others).

That leaves the time element. Someone suggested that I could post
the day's schedule on the usenet, using a mail2news gateway, on
a newsgroup called "alt.test". Haven't look into that. 

(I've posted on the usenet once, through google. It's a cesspool.
Be thankful we have someone like Steven running this mailing
list, or it could become one too. Many do. Takes a firm hand and
an open mind to keep things from getting out of hand often enough
to be a real problem.)

But that too complicated, because I'd have to have NNTP apps and
so would anyone wanting to access my server. 

I'm thinking I could have my connection and server up for 10
minutes at the top of every hour, from 3:00-10PM Pacific time,
and have a script to check my mail at the beginning of that
period, with a procmail auto-responder recipe sending my current
IP to anyone who sent me a mail with "FTP" anywhere on the
subject line. So if they sent the mail request anytime in the
previous hour, they'd have the current IP in time to use it.

My internet connection would stay up as long as someone was
connected to the server. (wget -c will maintain a connection
until the file is downloaded, stalling as long as necessary until
the download resumes. All good FTP clients have this option.)

This way, I can exchange files with anyone without
having to worry about the mail being waylaid by some
spam/virus/trojan/worm/spyware filter.

Relatively short, in-line (no attachments) plain-text mails are
twice as likely to make it to their destinations as a mail with
a non-plain-text attachment over 10K in size (total).

And the direct connection makes for greatly enhanced privacy. 

[delete]

Lee

-- 
BasicLinux: Small is Beautiful
http://www.basiclinux.com.ru