Mailing List Archive

On Tue, 19 Oct 2004 14:30:35 -0700
Grant <emailgrant@gmail.com> wrote:

> Is there a way to issue a single-line ftp command (via cron) to upload
> a file to a remote server? ftp seems to want you to issue the 'put'
> command manually after logged in.
>
> Also is it safe to log into an ftp server that doesn't support SSL?
> It seems like the password would be revealed that way.

yes thats right, most unsafe, use scp or rsync over ssh if your server
supports it.

solves both questions.



>
> - Grant
>
> --
> gentoo-user@gentoo.org mailing list

--
Nick Rout <nick@rout.co.nz>


--
gentoo-user@gentoo.org mailing list

> > Is there a way to issue a single-line ftp command (via cron) to upload
> > a file to a remote server? ftp seems to want you to issue the 'put'
> > command manually after logged in.

I just recently discovered wput; I use it in a script to transfer my
website to a remote FTP server. It works just like wget, but for
putting instead of getting files. And its in portage:

# emerge -pv wput


Matt

--
gentoo-user@gentoo.org mailing list

how do you specify the password to wput? I cannot see from the man page.

I therefore assume that you need to specifiy a url like
ftp://user:password@server/path/file

this means that not only are you using a plain text password over the
net, but also you are advertising it to all users on your system when
the command runs (via ps)

if you can user scp on the server do it!


On Tue, 19 Oct 2004 17:58:07 -0400
Matthew Cline <matthew.cline@gmail.com> wrote:

> > > Is there a way to issue a single-line ftp command (via cron) to upload
> > > a file to a remote server? ftp seems to want you to issue the 'put'
> > > command manually after logged in.
>
> I just recently discovered wput; I use it in a script to transfer my
> website to a remote FTP server. It works just like wget, but for
> putting instead of getting files. And its in portage:
>
> # emerge -pv wput
>
>
> Matt
>
> --
> gentoo-user@gentoo.org mailing list

--
Nick Rout <nick@rout.co.nz>


--
gentoo-user@gentoo.org mailing list

> this means that not only are you using a plain text password over the
> net

ftp is inherently insecure. You are always passing the pw in plain
text, be it on the command line or some other means. Unfortunately,
not every remote server offers the option of using scp or sftp, so you
need to understand the limitations and security implications of ftp
transfers

>but also you are advertising it to all users on your system when
> the command runs (via ps)

ps does not show the password used in the wput command, even when the
pw is specified on the command line (just try it). Further, wput does
not display the pw specified on the command line in its standard
output. To be even more secure, run wput from a shell script owned by
root with 700 perms.

>
> if you can user scp on the server do it!

Agreed, but not always available.


Matt

--
gentoo-user@gentoo.org mailing list

On Tue, 19 Oct 2004 20:30:45 -0500
Matthew Cline <matthew.cline@gmail.com> wrote:

> > this means that not only are you using a plain text password over the
> > net
>
> ftp is inherently insecure. You are always passing the pw in plain
> text, be it on the command line or some other means. Unfortunately,
> not every remote server offers the option of using scp or sftp, so you
> need to understand the limitations and security implications of ftp
> transfers
>
> >but also you are advertising it to all users on your system when
> > the command runs (via ps)
>
> ps does not show the password used in the wput command, even when the
> pw is specified on the command line (just try it). Further, wput does
> not display the pw specified on the command line in its standard
> output.

that is good to know. i could not see reference in the man page, thats
why i asked.

>To be even more secure, run wput from a shell script owned by
> root with 700 perms.
>
> >
> > if you can user scp on the server do it!
>
> Agreed, but not always available.
>

Thats why I prefaced "if you can..."

>
> Matt
>
> --
> gentoo-user@gentoo.org mailing list

--
Nick Rout <nick@rout.co.nz>


--
gentoo-user@gentoo.org mailing list

There is a way to use ftp in scripts. The downside is: your password
is stored and send in cleartext:

ftp www.somehost.com << EOF
USER username
PASS password
CD /home/username/public_html/
PUT a_file
BYE
EOF


works like a sharm. You can also use variables in the script, etc...

A more secure way is to use use scp without a password (but with keys
that are already in place). More info about how to do this canbe found
on:
http://aegir.homelinux.org/Homepage/linux/index.php?Page=SSHNoPass

--
gentoo-user@gentoo.org mailing list

On Tue, 19 Oct 2004 14:30:35 -0700, Grant <emailgrant@gmail.com> wrote:
> Is there a way to issue a single-line ftp command (via cron) to upload
> a file to a remote server? ftp seems to want you to issue the 'put'
> command manually after logged in.
> .........

Another way is lftp.

I have used lftp many times without any trouble whatsoever

emerge -v -a lftp if you want to try it....

anp

--
gentoo-user@gentoo.org mailing list

Agustin Navarro wrote:

>On Tue, 19 Oct 2004 14:30:35 -0700, Grant <emailgrant@gmail.com> wrote:
>
>
>>Is there a way to issue a single-line ftp command (via cron) to upload
>>a file to a remote server? ftp seems to want you to issue the 'put'
>>command manually after logged in.
>>.........
>>
>>
>
>Another way is lftp.
>
>I have used lftp many times without any trouble whatsoever
>
>emerge -v -a lftp if you want to try it....
>
>anp
>
>--
>gentoo-user@gentoo.org mailing list
>
>
>
ncftpget , which is part of net-ftp/ncftp.

Tom Veldhouse

--
Thomas T. Veldhouse
Key Fingerprint: 2DB9 813F F510 82C2 E1AE 34D0 D69D 1EDC D5EC AED1
Spammers please contact me at trap@veldy.net.