uploading to ftp site for students and the like

[Joel Hammer]

Just some ramblings.

I have seen from time to time people asking how they can set up an ftp
site so students and their ilk can upload homework but others can't see
it or erase it or whatever.

I have often though that a simple daemon looking at the upload directory
which removes uploaded files to a safe location would be the ticket,
but nobody ever seems enthused about that.

So, another brilliant insight. Make the upload directory unwritable but
make a pipe in that directory  writable.

It is assumed that this is an anonymous site, otherwise there wouldn't
be this sort of security issue.

Make the directory:
drwxr-xr-x    2 root   root          

Make a named pipe in this directory, like so:
mkfifo mypipe
chmod 1777 mypipe
So, you then have this:
prwxrwxrwt    1 root     root   0 Dec  9 20:44 mypipe

Then, run a daemon (I must like daemons), something like this:

#!/bin/bash
while :
do
rm /tmp/$$
cat < mypipe > /tmp/$$ 
a=`date | sed "s/  / /g" | sed "s/ /_/g"`
mv /tmp/$$ /Wherever/$a
sleep 1
done

The students are told to upload to the mypipe file:
     put localfile mypipe

I do not believe they would be able to make a mistake and just put
the file to this directory under its own name because of the directory
permissions. Only the pipe is writable to regular users.


Well, this is rough, but the idea looks like it might be useful. I
haven't tried to find out what happens when two ftp sessions try to
access the pipe at the same time. It would be nice if the user name could
be prepended to the file name. And, I am not sure how the student will
know that his/her file has been uploaded successfully.

Joel