Re: [Eug-lug]Dynamic Ip

2002-12-10 Thread Dave Wyatt
Thanks for all the ideas and possible solutions.

I have gone with Winscp, it really makes it easy for
the windows user.  

Dave


--- Dave Wyatt [EMAIL PROTECTED] wrote:
 The Winscp you mentioned seems to work nicely.  I
 prefer the free or low cost solution(s), as I am
 sure
 most of us do.  I'm still looking and I'll let you
 (and the list) know what I end up using.
 
 Dave
 
 --- Cory Petkovsek [EMAIL PROTECTED] wrote:
  Dave,
  
  When looking for a client, search around for the
  keyword sftp.  The
  protocol is really ssh2 running over port 22 and
 has
  little to do with
  the ftp protocol running on port 21.  psftp is a
  program from the putty
  suite.
  
  Jacob mentioned coolftp, but I'm not sure if that
 is
  no-cost.  I
  mentioned a windows client that is freeware but
  I'm not sure if that
  really means no-cost ware or free speech ware.
  
  Cory
  
 - Snip!
 -
 
 __
 Do you Yahoo!?
 Yahoo! Mail Plus - Powerful. Affordable. Sign up
 now.
 http://mailplus.yahoo.com
 ___
 Eug-LUG mailing list
 [EMAIL PROTECTED]
 http://mailman.efn.org/cgi-bin/listinfo/eug-lug


__
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-09 Thread Jacob Meuser
On Sat, Dec 07, 2002 at 09:20:10PM -0800, Linux Rocks! wrote:
 Couldnt you just have a login/logout script that checks the users connection, 
 and update the hosts.allow ?

One can use authpf on OpenBSD (ssh authentication to change packet
filter/translation rules).

http://www.openbsd.org/cgi-bin/man.cgi?query=authpf

-- 
[EMAIL PROTECTED]
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-08 Thread mike
Granted their IP address changes but usually only the last part. Just a guess 
but couldnt you restrict access except from local lan addresses and from 
their ISP? then use htpasswd to let them login with name and pass.

id be worried about anything that dynamically changes the hosts.allow on the 
fly. someone would find a way to spoof it.

On Sunday 08 December 2002 12:20 am, Linux Rocks ! wrote:
 Couldnt you just have a login/logout script that checks the users
 connection, and update the hosts.allow ?

 Jamie

 On Saturday 07 December 2002 09:06 pm, Bob Miller wrote:
 : Dave Wyatt wrote:
 :  We have a web server and the public is not allowed to
 :  access via FTp (a good thing).  It is set up so the
 :  web directories can be accessed from the internal
 :  network and one or two ip addresses from the external
 :  network (internet).
 : 
 :  The problem is one of the owners wants to be able to
 :  make changes to the site from their home DSL service
 :  (Rio) but their IP is different each time they log on.
 :   Is there a way to authorize that person since they
 :  have a dynamic IP but no real Domain Name?
 :
 : I read what Cory, Jake, and Mike said, and the scp solution is
 : reasonable.  But here's another idea.
 :
 : Mozilla has Composer, a decent WYSIWYG HTML editor.  Composer has a
 : Publish button.  If you set up publishing settings to use
 : http:... or https:... as the publishing address, then it will use an
 : HTTP PUT command to write the file directly into the document root.
 :
 : From the user's POV, this is ideal.  He loads a page into Composer (or
 : creates a new page).  He edits it.  He hits Publish.  The page is
 : instantly live on the web.  What could be better?
 :
 : You can set up authentication in a number of ways.
 :
 : Best (most secure) would be to run Apache-SSL as well as Apache.
 : Then you can set the permissions in Apache-SSL's httpd.conf to
 : allow certain users to PUT.  Don't use the same username/passwords
 : that the non-SSL site uses (if it uses any).  Then the user
 : has to use the https:... address to edit the page.
 :
 : Good (sort of secure) would be to allow users to authenticate with
 : digest authentication. (Use the AuthType directive.)  Using digest
 : authentication, an eavesdropper can see the stuff being uploaded,
 : but can't upload stuff him/herself.
 :
 : Bad (not secure at all) would be to allow users to PUT without
 : authentication, or to use basic authentication.  That might be
 : acceptable in an intranet, where everybody is trusted.  But it
 : wouldn't work if the same server is also visible from The Internet.
 :
 : I'm sorry this isn't a cookbook procedure.  I have never set the whole
 : thing up this way, though I've played with most of the pieces.  But it
 : shouldn't be too hard, if you're comfortable configuring Apache.
 :
 : I have no idea whether IE also has a composer module.  And I ain't
 : apologizing for that! (-:

___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-08 Thread Dave Wyatt
The Winscp you mentioned seems to work nicely.  I
prefer the free or low cost solution(s), as I am sure
most of us do.  I'm still looking and I'll let you
(and the list) know what I end up using.

Dave

--- Cory Petkovsek [EMAIL PROTECTED] wrote:
 Dave,
 
 When looking for a client, search around for the
 keyword sftp.  The
 protocol is really ssh2 running over port 22 and has
 little to do with
 the ftp protocol running on port 21.  psftp is a
 program from the putty
 suite.
 
 Jacob mentioned coolftp, but I'm not sure if that is
 no-cost.  I
 mentioned a windows client that is freeware but
 I'm not sure if that
 really means no-cost ware or free speech ware.
 
 Cory
 
- Snip! -

__
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-08 Thread Dave Wyatt

--- Bob Miller [EMAIL PROTECTED] wrote:
 Dave Wyatt wrote:
 
  We have a web server and the public is not allowed
 to
  access via FTp (a good thing).  It is set up so
 the
  web directories can be accessed from the internal
  network and one or two ip addresses from the
 external
  network (internet).
  
  The problem is one of the owners wants to be able
 to
  make changes to the site from their home DSL
 service
  (Rio) but their IP is different each time they log
 on.
   Is there a way to authorize that person since
 they
  have a dynamic IP but no real Domain Name?
 
 I read what Cory, Jake, and Mike said, and the scp
 solution is
 reasonable.  But here's another idea.
 
 Mozilla has Composer, a decent WYSIWYG HTML editor. 
 Composer has a
 Publish button.  If you set up publishing settings
 to use
 http:... or https:... as the publishing address,
 then it will use an
 HTTP PUT command to write the file directly into the
 document root.
 
 From the user's POV, this is ideal.  He loads a page
 into Composer (or
 creates a new page).  He edits it.  He hits
 Publish.  The page is
 instantly live on the web.  What could be better?
 
 You can set up authentication in a number of ways.
 
 Best (most secure) would be to run Apache-SSL as
 well as Apache.
 Then you can set the permissions in Apache-SSL's
 httpd.conf to
 allow certain users to PUT.  Don't use the same
 username/passwords
 that the non-SSL site uses (if it uses any).  Then
 the user
 has to use the https:... address to edit the page.
 
 Good (sort of secure) would be to allow users to
 authenticate with
 digest authentication. (Use the AuthType
 directive.)  Using digest
 authentication, an eavesdropper can see the stuff
 being uploaded,
 but can't upload stuff him/herself.
 
 Bad (not secure at all) would be to allow users to
 PUT without
 authentication, or to use basic authentication. 
 That might be
 acceptable in an intranet, where everybody is
 trusted.  But it
 wouldn't work if the same server is also visible
 from The Internet.
 
 I'm sorry this isn't a cookbook procedure.  I have
 never set the whole
 thing up this way, though I've played with most of
 the pieces.  But it
 shouldn't be too hard, if you're comfortable
 configuring Apache.
 
 I have no idea whether IE also has a composer
 module.  And I ain't
 apologizing for that! (-:
 
 -- 
 Bob Miller  Kbob
 kbobsoft software consulting
 http://kbobsoft.com
 [EMAIL PROTECTED]
 ___
 Eug-LUG mailing list
 [EMAIL PROTECTED]
 http://mailman.efn.org/cgi-bin/listinfo/eug-lug


Nice solution.  If I were to do it this way, I would
use SSL authentication since SSL is already in place. 
Only problem I see is they will try to use Front Page
or something else and my experience with most WYSIWYG
editors is badly muked-up code (that mostly works but
is a mess to clean up).  I have to admit I haven't
used any WYSIWYG editors for quite awhile so maybe
they have improved, but I don't want to encourage
their use.

Anyway, its great to get all these ideas.   Now I just
need to get something implimented.

Dave

__
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-08 Thread Dave Wyatt
Probably, but I'm not too good with scripts and
dynamically updating the hosts.allow  is scary to me. 
I think I prefer an  OpenSSH solution.

Dave


--- Linux Rocks ! [EMAIL PROTECTED] wrote:
 Couldnt you just have a login/logout script that
 checks the users connection, 
 and update the hosts.allow ?
 
 Jamie
 
 On Saturday 07 December 2002 09:06 pm, Bob Miller
 wrote:
 : Dave Wyatt wrote:
 :  We have a web server and the public is not
 allowed to
 :  access via FTp (a good thing).  It is set up so
 the
 :  web directories can be accessed from the
 internal
 :  network and one or two ip addresses from the
 external
 :  network (internet).
 : 
 :  The problem is one of the owners wants to be
 able to
 :  make changes to the site from their home DSL
 service
 :  (Rio) but their IP is different each time they
 log on.
 :   Is there a way to authorize that person since
 they
 :  have a dynamic IP but no real Domain Name?
 :
- SNIP! ---

__
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-08 Thread Dave Wyatt
In 4 hours time the IP changed from xx.xxx.123.178 to
xx.xxx.153.225.  That is not the real ips of course,
but that is a large range to let in.  If it were just
the last 255 it wouldn't be so bad.  I think I still
like the SFTP or SCP thing.

Dave
 

--- mike [EMAIL PROTECTED] wrote:
 Granted their IP address changes but usually only
 the last part. Just a guess 
 but couldnt you restrict access except from local
 lan addresses and from 
 their ISP? then use htpasswd to let them login with
 name and pass.
 
 id be worried about anything that dynamically
 changes the hosts.allow on the 
 fly. someone would find a way to spoof it.
 
 On Sunday 08 December 2002 12:20 am, Linux Rocks !
 wrote:
  Couldnt you just have a login/logout script that
 checks the users
  connection, and update the hosts.allow ?
 
  Jamie
 


__
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-07 Thread Cory Petkovsek
Dave, how about password/key authentication instead of ip filtering?

What I mean is ssh.  I assume you're using a unix based webserver.
You can use ssh for issuing commands, scp to copy files up or down and
sftp for a secure ftp session.  It all uses port 22 and the ssh2
protocol.  For a windows client you can use putty(terminal) or
pscp(remote cp) or psftp.
http://www.chiark.greenend.org.uk/~sgtatham/putty/
here's a windows gui for windows scp:
http://winscp.vse.cz/eng/

Either alternatively, or in addition, you can setup the server to allow
in only RIO's dhcp pool.  This is far better than allowing 2^32
addresses.  You can get the address space from RIO's tech support line.
This address space would then go in your firewall packet filter ruleset
(ie ipchains/iptables).

Finally, there are several secure ftp packages available.  

Here's one I just found that is GPL'd.  It is a standard ftp server, but supposedly is 
designed securely and used by some linux sites such as:
ftp\.((redhat|suse)\.com|(debian|openbsd|gnu)\.org)

http://vsftpd.beasts.org/

Cory

On Sat, Dec 07, 2002 at 09:27:33AM -0800, Dave Wyatt wrote:
 We have a web server and the public is not allowed to
 access via FTp (a good thing).  It is set up so the
 web directories can be accessed from the internal
 network and one or two ip addresses from the external
 network (internet).
 
 The problem is one of the owners wants to be able to
 make changes to the site from their home DSL service
 (Rio) but their IP is different each time they log on.
  Is there a way to authorize that person since they
 have a dynamic IP but no real Domain Name?
 
 TIA,
 Dave 
 
 __
 Do you Yahoo!?
 Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
 http://mailplus.yahoo.com
 ___
 Eug-LUG mailing list
 [EMAIL PROTECTED]
 http://mailman.efn.org/cgi-bin/listinfo/eug-lug
 
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-07 Thread Jacob Meuser
On Sat, Dec 07, 2002 at 12:28:14PM -0800, Cory Petkovsek wrote:

 Finally, there are several secure ftp packages available.  

Actually, if you look at (probably the last line of) /etc/ssh/sshd_config,
you may see:

Subsystem   sftp/path/to/sftp-server

In other words, OpenSSH's sshd has a secure ftp service ready to go.
The nice thing is, it uses ssh authentication, so the setup is the
same as ssh.

 Here's one I just found that is GPL'd.  It is a standard ftp server, but supposedly 
is designed securely and used by some linux sites such as:
 ftp\.((redhat|suse)\.com|(debian|openbsd|gnu)\.org)
 
 http://vsftpd.beasts.org/

Well, this is designed to be a fast and secure way to _server files to
the public_.  He needs a way to _upload_ securely.  If he's using a
*nix desktop, gFTP - http://www.gftp.org/ is a gui ftp client,
slightly similar to CuteFTP, that supports OpenSSH sftp.  There's
also a 'sftp' command that probably comes with the ssh  scp package
for your distro.

BTW, http://www.openbsd.org/faq/faq8.html#wwwsolaris

-- 
[EMAIL PROTECTED]
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-07 Thread Dave Wyatt
Thanks Cory,

The web server is Apache on a Red Hat 6.2 system.  

I thought of ssh but they will be using Windows98 and
I wasn't confident of their use of the command console
in Putty.  If there is a GUI that will work with SFTP
or SCP that may very well be the way to go.  As usual,
your comments are right on top of things.  They just
need a way to download and upload files and ssh is
already in place (I just haven't told them about it.
They are not Linux or command line savy).  If I can
set them up with a gui in windows it will be perfect. 
Thanks again,

Dave

--- Cory Petkovsek [EMAIL PROTECTED] wrote:
 Dave, how about password/key authentication instead
 of ip filtering?
 
 What I mean is ssh.  I assume you're using a unix
 based webserver.
 You can use ssh for issuing commands, scp to copy
 files up or down and
 sftp for a secure ftp session.  It all uses port 22
 and the ssh2
 protocol.  For a windows client you can use
 putty(terminal) or
 pscp(remote cp) or psftp.
 http://www.chiark.greenend.org.uk/~sgtatham/putty/
 here's a windows gui for windows scp:
 http://winscp.vse.cz/eng/
 
 Either alternatively, or in addition, you can setup
 the server to allow
 in only RIO's dhcp pool.  This is far better than
 allowing 2^32
 addresses.  You can get the address space from RIO's
 tech support line.
 This address space would then go in your firewall
 packet filter ruleset
 (ie ipchains/iptables).
 
 Finally, there are several secure ftp packages
 available.  
 
 Here's one I just found that is GPL'd.  It is a
 standard ftp server, but supposedly is designed
 securely and used by some linux sites such as:
 ftp\.((redhat|suse)\.com|(debian|openbsd|gnu)\.org)
 
 http://vsftpd.beasts.org/
 
 Cory
 
 On Sat, Dec 07, 2002 at 09:27:33AM -0800, Dave Wyatt
 wrote:
  We have a web server and the public is not allowed
 to
  access via FTp (a good thing).  It is set up so
 the
  web directories can be accessed from the internal
  network and one or two ip addresses from the
 external
  network (internet).
  
  The problem is one of the owners wants to be able
 to
  make changes to the site from their home DSL
 service
  (Rio) but their IP is different each time they log
 on.
   Is there a way to authorize that person since
 they
  have a dynamic IP but no real Domain Name?
  
  TIA,
  Dave 
  
  __
  Do you Yahoo!?
  Yahoo! Mail Plus - Powerful. Affordable. Sign up
 now.
  http://mailplus.yahoo.com
  ___
  Eug-LUG mailing list
  [EMAIL PROTECTED]
  http://mailman.efn.org/cgi-bin/listinfo/eug-lug
  
 ___
 Eug-LUG mailing list
 [EMAIL PROTECTED]
 http://mailman.efn.org/cgi-bin/listinfo/eug-lug


__
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-07 Thread Dave Wyatt


 Jacob, You are right on target also.  I failed to say
they will be using Windows98 and connecting to a Red
Hat 6.2 system.  I just need a Windows98 gui that will
work with sftp (or psftp) and problem solved.  I will
look into CuteFTP for Windows and see if it will do
the job.

Thanks, 

Dave

 
--- Jacob Meuser [EMAIL PROTECTED] wrote:
 On Sat, Dec 07, 2002 at 12:28:14PM -0800, Cory
 Petkovsek wrote:
 
  Finally, there are several secure ftp packages
 available.  
 
 Actually, if you look at (probably the last line of)
 /etc/ssh/sshd_config,
 you may see:
 
 Subsystem sftp/path/to/sftp-server
 
 In other words, OpenSSH's sshd has a secure ftp
 service ready to go.
 The nice thing is, it uses ssh authentication, so
 the setup is the
 same as ssh.
 
  Here's one I just found that is GPL'd.  It is a
 standard ftp server, but supposedly is designed
 securely and used by some linux sites such as:
 
 ftp\.((redhat|suse)\.com|(debian|openbsd|gnu)\.org)
  
  http://vsftpd.beasts.org/
 
 Well, this is designed to be a fast and secure way
 to _server files to
 the public_.  He needs a way to _upload_ securely. 
 If he's using a
 *nix desktop, gFTP - http://www.gftp.org/ is a gui
 ftp client,
 slightly similar to CuteFTP, that supports OpenSSH
 sftp.  There's
 also a 'sftp' command that probably comes with the
 ssh  scp package
 for your distro.
 
 BTW, http://www.openbsd.org/faq/faq8.html#wwwsolaris
 
 -- 
 [EMAIL PROTECTED]
 ___
 Eug-LUG mailing list
 [EMAIL PROTECTED]
 http://mailman.efn.org/cgi-bin/listinfo/eug-lug


__
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-07 Thread Mike O
So you have people that need to point and click but
you want to do 'scp'? Why not say so in the first
place? Just kidding. Go to www.ssh.com and download
their client for Windows boxes. Included is a Secure
FTP clients that allows dragging and dropping of files
to the box. I have my girlfriend using that up in
Portland to pull music off my box here. No command
line stuff for her to worry about. All she needs to
know is the IP address of my fileserver as well as a
login name and password and she downloads away. Easier
than pie. Wish I could make a pie! :) 


--- Dave Wyatt [EMAIL PROTECTED] wrote:
 Thanks Cory,
 
 The web server is Apache on a Red Hat 6.2 system.  
 
 I thought of ssh but they will be using Windows98
 and
 I wasn't confident of their use of the command
 console
 in Putty.  If there is a GUI that will work with
 SFTP
 or SCP that may very well be the way to go.  As
 usual,
 your comments are right on top of things.  They just
 need a way to download and upload files and ssh is
 already in place (I just haven't told them about it.
 They are not Linux or command line savy).  If I can
 set them up with a gui in windows it will be
 perfect. 
 Thanks again,
 
 Dave


__
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-07 Thread Dave Wyatt
Sounds perfect.   Thanks!

Dave


--- Mike O [EMAIL PROTECTED] wrote:
 So you have people that need to point and click but
 you want to do 'scp'? Why not say so in the first
 place? Just kidding. Go to www.ssh.com and download
 their client for Windows boxes. Included is a Secure
 FTP clients that allows dragging and dropping of
 files
 to the box. I have my girlfriend using that up in
 Portland to pull music off my box here. No command
 line stuff for her to worry about. All she needs to
 know is the IP address of my fileserver as well as a
 login name and password and she downloads away.
 Easier
 than pie. Wish I could make a pie! :) 
 
 
 --- Dave Wyatt [EMAIL PROTECTED] wrote:
  Thanks Cory,
  
  The web server is Apache on a Red Hat 6.2 system. 
 
  
  I thought of ssh but they will be using Windows98
  and
  I wasn't confident of their use of the command
  console
  in Putty.  If there is a GUI that will work with
  SFTP
  or SCP that may very well be the way to go.  As
  usual,
  your comments are right on top of things.  They
 just
  need a way to download and upload files and ssh is
  already in place (I just haven't told them about
 it.
  They are not Linux or command line savy).  If I
 can
  set them up with a gui in windows it will be
  perfect. 
  Thanks again,
  
  Dave
 
 
 __
 Do you Yahoo!?
 Yahoo! Mail Plus - Powerful. Affordable. Sign up
 now.
 http://mailplus.yahoo.com
 ___
 Eug-LUG mailing list
 [EMAIL PROTECTED]
 http://mailman.efn.org/cgi-bin/listinfo/eug-lug


__
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-07 Thread P Casper
On Sat, 2002-12-07 at 16:19, Mike O wrote:

 than pie. Wish I could make a pie! :) 
 
Pie's pretty easy.
10 GOTO Store;
20 SELECT $flavor_pie;
30 checkout;
40 INSERT $flavor_pie OVEN;
50 SET temp 400 || $pie_temp_on_box;
60 WAIT 60;
70 Remove $flavor_pie OVEN;
80 Eat;

*grins impishly*

PC

-- 
P Casper [EMAIL PROTECTED]
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-07 Thread Cory Petkovsek
Dave,

When looking for a client, search around for the keyword sftp.  The
protocol is really ssh2 running over port 22 and has little to do with
the ftp protocol running on port 21.  psftp is a program from the putty
suite.

Jacob mentioned coolftp, but I'm not sure if that is no-cost.  I
mentioned a windows client that is freeware but I'm not sure if that
really means no-cost ware or free speech ware.

Cory

On Sat, Dec 07, 2002 at 04:09:08PM -0800, Dave Wyatt wrote:
 Thanks Cory,
 
 The web server is Apache on a Red Hat 6.2 system.  
 
 I thought of ssh but they will be using Windows98 and
 I wasn't confident of their use of the command console
 in Putty.  If there is a GUI that will work with SFTP
 or SCP that may very well be the way to go.  As usual,
 your comments are right on top of things.  They just
 need a way to download and upload files and ssh is
 already in place (I just haven't told them about it.
 They are not Linux or command line savy).  If I can
 set them up with a gui in windows it will be perfect. 
 Thanks again,
 
 Dave
 
 --- Cory Petkovsek [EMAIL PROTECTED] wrote:
  Dave, how about password/key authentication instead
  of ip filtering?
  
  What I mean is ssh.  I assume you're using a unix
  based webserver.
  You can use ssh for issuing commands, scp to copy
  files up or down and
  sftp for a secure ftp session.  It all uses port 22
  and the ssh2
  protocol.  For a windows client you can use
  putty(terminal) or
  pscp(remote cp) or psftp.
  http://www.chiark.greenend.org.uk/~sgtatham/putty/
  here's a windows gui for windows scp:
  http://winscp.vse.cz/eng/
  
  Either alternatively, or in addition, you can setup
  the server to allow
  in only RIO's dhcp pool.  This is far better than
  allowing 2^32
  addresses.  You can get the address space from RIO's
  tech support line.
  This address space would then go in your firewall
  packet filter ruleset
  (ie ipchains/iptables).
  
  Finally, there are several secure ftp packages
  available.  
  
  Here's one I just found that is GPL'd.  It is a
  standard ftp server, but supposedly is designed
  securely and used by some linux sites such as:
  ftp\.((redhat|suse)\.com|(debian|openbsd|gnu)\.org)
  
  http://vsftpd.beasts.org/
  
  Cory
  
  On Sat, Dec 07, 2002 at 09:27:33AM -0800, Dave Wyatt
  wrote:
   We have a web server and the public is not allowed
  to
   access via FTp (a good thing).  It is set up so
  the
   web directories can be accessed from the internal
   network and one or two ip addresses from the
  external
   network (internet).
   
   The problem is one of the owners wants to be able
  to
   make changes to the site from their home DSL
  service
   (Rio) but their IP is different each time they log
  on.
Is there a way to authorize that person since
  they
   have a dynamic IP but no real Domain Name?
   
   TIA,
   Dave 
   
   __
   Do you Yahoo!?
   Yahoo! Mail Plus - Powerful. Affordable. Sign up
  now.
   http://mailplus.yahoo.com
   ___
   Eug-LUG mailing list
   [EMAIL PROTECTED]
   http://mailman.efn.org/cgi-bin/listinfo/eug-lug
   
  ___
  Eug-LUG mailing list
  [EMAIL PROTECTED]
  http://mailman.efn.org/cgi-bin/listinfo/eug-lug
 
 
 __
 Do you Yahoo!?
 Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
 http://mailplus.yahoo.com
 ___
 Eug-LUG mailing list
 [EMAIL PROTECTED]
 http://mailman.efn.org/cgi-bin/listinfo/eug-lug
 
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-07 Thread Cory Petkovsek
PC, My pie didn't work out!  My whole kitchen caught on fire!

$ gdb make_a_pie
(gdb) step
 10 GOTO Store;
Welcome to the Kiva...
(gdb) step
 20 SELECT $flavor_pie;
(gdb) print $flavor_pie
$1 = 12oz can of apple pie mix + Plastic wrapped crust in aluminum pan
(gdb) step
 30 checkout;
Thanks for shopping at the Kiva!
(gdb) step
 40 INSERT $flavor_pie $OVEN;
(gdb) step
 50 SET $temp 400 || $pie_temp_on_box;
(gdb) step
 60 WAIT 60;
Segmentation Fault
(gdb) print $temp
$2 = 700
(gdb) print $errstr
$3 = Smoke Alarm
(gdb) print $OVEN-status
$4 = On Fire
(gdb) print $flavor_pie
$5 = Melted 12oz can + burning apple pie mix + vaporized plastic wrap +\
burnt aluminum pan
(gdb) quit 
A debugging session is active.
Do you still want to close the debugger?(y or n) y
$ rm make_a_pie

;)

On Sat, Dec 07, 2002 at 05:10:10PM -0800, P Casper wrote:
 On Sat, 2002-12-07 at 16:19, Mike O wrote:
 
  than pie. Wish I could make a pie! :) 
  
 Pie's pretty easy.
 10 GOTO Store;
 20 SELECT $flavor_pie;
 30 checkout;
 40 INSERT $flavor_pie OVEN;
 50 SET temp 400 || $pie_temp_on_box;
 60 WAIT 60;
 70 Remove $flavor_pie OVEN;
 80 Eat;
 
 *grins impishly*
 
 PC
 
 -- 
 P Casper [EMAIL PROTECTED]
 ___
 Eug-LUG mailing list
 [EMAIL PROTECTED]
 http://mailman.efn.org/cgi-bin/listinfo/eug-lug
 
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-07 Thread Bob Miller
Dave Wyatt wrote:

 We have a web server and the public is not allowed to
 access via FTp (a good thing).  It is set up so the
 web directories can be accessed from the internal
 network and one or two ip addresses from the external
 network (internet).
 
 The problem is one of the owners wants to be able to
 make changes to the site from their home DSL service
 (Rio) but their IP is different each time they log on.
  Is there a way to authorize that person since they
 have a dynamic IP but no real Domain Name?

I read what Cory, Jake, and Mike said, and the scp solution is
reasonable.  But here's another idea.

Mozilla has Composer, a decent WYSIWYG HTML editor.  Composer has a
Publish button.  If you set up publishing settings to use
http:... or https:... as the publishing address, then it will use an
HTTP PUT command to write the file directly into the document root.

From the user's POV, this is ideal.  He loads a page into Composer (or
creates a new page).  He edits it.  He hits Publish.  The page is
instantly live on the web.  What could be better?

You can set up authentication in a number of ways.

Best (most secure) would be to run Apache-SSL as well as Apache.
Then you can set the permissions in Apache-SSL's httpd.conf to
allow certain users to PUT.  Don't use the same username/passwords
that the non-SSL site uses (if it uses any).  Then the user
has to use the https:... address to edit the page.

Good (sort of secure) would be to allow users to authenticate with
digest authentication. (Use the AuthType directive.)  Using digest
authentication, an eavesdropper can see the stuff being uploaded,
but can't upload stuff him/herself.

Bad (not secure at all) would be to allow users to PUT without
authentication, or to use basic authentication.  That might be
acceptable in an intranet, where everybody is trusted.  But it
wouldn't work if the same server is also visible from The Internet.

I'm sorry this isn't a cookbook procedure.  I have never set the whole
thing up this way, though I've played with most of the pieces.  But it
shouldn't be too hard, if you're comfortable configuring Apache.

I have no idea whether IE also has a composer module.  And I ain't
apologizing for that! (-:

-- 
Bob Miller  Kbob
kbobsoft software consulting
http://kbobsoft.com [EMAIL PROTECTED]
___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug



Re: [Eug-lug]Dynamic Ip

2002-12-07 Thread Linux Rocks !
Couldnt you just have a login/logout script that checks the users connection, 
and update the hosts.allow ?

Jamie

On Saturday 07 December 2002 09:06 pm, Bob Miller wrote:
: Dave Wyatt wrote:
:  We have a web server and the public is not allowed to
:  access via FTp (a good thing).  It is set up so the
:  web directories can be accessed from the internal
:  network and one or two ip addresses from the external
:  network (internet).
: 
:  The problem is one of the owners wants to be able to
:  make changes to the site from their home DSL service
:  (Rio) but their IP is different each time they log on.
:   Is there a way to authorize that person since they
:  have a dynamic IP but no real Domain Name?
:
: I read what Cory, Jake, and Mike said, and the scp solution is
: reasonable.  But here's another idea.
:
: Mozilla has Composer, a decent WYSIWYG HTML editor.  Composer has a
: Publish button.  If you set up publishing settings to use
: http:... or https:... as the publishing address, then it will use an
: HTTP PUT command to write the file directly into the document root.
:
: From the user's POV, this is ideal.  He loads a page into Composer (or
: creates a new page).  He edits it.  He hits Publish.  The page is
: instantly live on the web.  What could be better?
:
: You can set up authentication in a number of ways.
:
: Best (most secure) would be to run Apache-SSL as well as Apache.
: Then you can set the permissions in Apache-SSL's httpd.conf to
: allow certain users to PUT.  Don't use the same username/passwords
: that the non-SSL site uses (if it uses any).  Then the user
: has to use the https:... address to edit the page.
:
: Good (sort of secure) would be to allow users to authenticate with
: digest authentication. (Use the AuthType directive.)  Using digest
: authentication, an eavesdropper can see the stuff being uploaded,
: but can't upload stuff him/herself.
:
: Bad (not secure at all) would be to allow users to PUT without
: authentication, or to use basic authentication.  That might be
: acceptable in an intranet, where everybody is trusted.  But it
: wouldn't work if the same server is also visible from The Internet.
:
: I'm sorry this isn't a cookbook procedure.  I have never set the whole
: thing up this way, though I've played with most of the pieces.  But it
: shouldn't be too hard, if you're comfortable configuring Apache.
:
: I have no idea whether IE also has a composer module.  And I ain't
: apologizing for that! (-:

-- 
No microsoft products were used to produce this message.
EUG-LUG Mailing List:
http://mailman.efn.org/cgi-bin/listinfo/eug-lug

___
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug