DSL Ideas and Suggestions :: Lightweight and secure anonymous ftpd.
Sometimes I found myself in a cituation where I need to put some files to public share. I have used BetaFtpd for that (With DSL, of course). It has (? Correct me if I'm wrong) one small disadvantage: no anonympus/public access. Only way is to make a new user and set it's home directory where the files are that I want to share. That also means that I have to share the password and user account to everyone who want's to log into my ftp server. I'm just too lazy to tweak that account to be ftp only ----> anyone can log into my system via ssh with that login name and password ---> not good. Ok. I could write a simple script that does all that. But still user who logs to my ftp server needs to type login and pass and is able to move up from it's home directory (in some cases that is also a security risk).
So here's my suggestion: oftpd. It's just what this topic's title says. =)
I haven't tested it much, but I will report all the good features and flaws here. =)
Ok. It seems that oftpd does not follow any symbolic links. That's kinda bad I think, but also very secure.
I use bftpd. It has anonymous possibility; it's also very small, though not betaftpd class (at size)
Could you try chrooting the ftp daemon? To prevent the users from leaving the home directory?
original here.