1

I have a bunch of video file I would like my friend to be able to download at his convenience. He can figure out how to use an ftp client, stuff like that, but he's not tech savvy as such, so I would prefer a way that requires him to do as little as possible.

My setup:

  • a fast fiber connection, which is awesome btw.

  • a couple of old rack servers running 24/7, which is a bit noisy but also awesome.

  • a network setup with a dedicated DMZ that can't reach my private LAN

Currently I have two virtual servers running in the DMZ, the first one a file server called dmzstorage and the second one called accessserver, both running ubuntu server 18.04

The idea is that dmzstorage holds the files I want to share, while accessserver has a read only NFS connection to the shared files on dmzstorage and handles the access from the outside. It allows me to quickly and easily try a number of options for outside access while keeping the file server untouched. I can build a bunch of different versions of the accessserver virtually and end up keeping the one I like the best.

I've been experimenting with sftp on the accessserver.

I like that it's secure and only requires my friend to find an ftp client that supports sftp (which many do).

I dislike that I have to open port 22 to the outside. Even though I've created a user for my friend with no shell access it still rubs me the wrong way to leave port 22 open.

One solution could be to run two instances of ssh on the accessserver, a regular one on port 22 so I can manage the server from my LAN and another sftp only instance running on port 2222 and then have my firewall translate my outside ip at port 22 to my accessserver at port 2222 - that way my friend wouldn't notice the difference and the black hats would try to accomplish ssh access on a port that doesn't support an ssh shell.

Question is, is there a smarter/better/simpler way to do this? The accessserver doesn't have to run linux if things are done better with some turnkey solution or maybe windows, setting up a samba share on dmzstorage is no biggie.

So how would you do it?

closed as too broad by user68186, vanadium, N0rbert, waltinator, Eric Carvalho Oct 19 '18 at 12:22

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • i give friends access to my files via openvpn using certificates for authentication. This way i can leave all ports at my router closed, apart for the one to connect to my vpn-server. After the vpn connection is established files can be shared thru whatever protocol you like. – AlexOnLinux Oct 18 '18 at 12:10
  • 1
    As little as possible? Seed a torrent (Transmission is included with Ubuntu), and e-mail your friend the URL. No tech-savvy required. Neither needs to configure anything - Transmission will do it all. Be advised that since it is torrent, others may discover and join the swarm, but you can limit (not eliminate) that by not posting to trackers. – user535733 Oct 18 '18 at 13:00
  • 1
    Another super-easy alternative: Mail your friend a USB stick. – user535733 Oct 18 '18 at 13:03
0

If you want your friend to access these files directly on your network, you will have to open some kind of port. You could add some security through obscurity by using a random port to the outside world (as you already suggested).

You didn't tell us what kind of firewall/router you are using, but generally it should be possible to have your port forwarded to the internet with a random number, while still being able to access it internally with a different port, though I don't quite understand the reason why you would want a different port number instead of just using the same (random) port internally and externally:

https://www.liquidweb.com/kb/changing-the-ssh-port/

Apart from that, SFTP is probably the easiest to set up while providing the features you need. A slightly more complex solution might be FTPS with vsftpd which is only slight more complex to set up and also provides encryption.

Not the answer you're looking for? Browse other questions tagged or ask your own question.