Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: SFTPGo 0.9.6

github.com

Post reply on HN
Print view View original

1–10 of 11 posts

Re: Show HN: SFTPGo 0.9.6

#3

Post by nolok »

dillonmckay wrote: post #2

So, at my work, we host both SFTP and FTP to receive data feeds. Has anyone seen an FTP honeypot that would serve zip bombs to malicious users and allow legit users proper access?

I've always imagined the risk of someone doing that on purpose to something they then post on /r/opendirectories

Most of those people seem to grab and open those files without any security measures, docx, pdf, archives, often .exe

Re: Show HN: SFTPGo 0.9.6

#4

Post by jay_wild »

dillonmckay wrote: post #2

So, at my work, we host both SFTP and FTP to receive data feeds. Has anyone seen an FTP honeypot that would serve zip bombs to malicious users and allow legit users proper access?

Cowrie [0] provides an SFTP and Telnet honeypot and you can configure the filesystem to serve your desired files. Not quite a passthrough for legitimate use, unfortunately

[0]: https://github.com/cowrie/cowrie

Re: Show HN: SFTPGo 0.9.6

#6

Post by drakkan »

dang wrote: post #5

A thread on this project from last year: https://news.ycombinator.com/item?id=20531541 If you're going to make a Show HN out of a new release, it would be good to add a comment explaining what's different since last time!

Yes sorry, the project improved a lot since then, all the issues raised in that thread were addressed and several new features were added: we now support serving Cloud Storage backend (such as S3) over SFTP/SCP, multi factor authentication, virtual folders, several filters (for example on file extensions, on source ip address), external authentication, serving Git repos over SSH, per directory virtual permissions (not related to OS permissions) ecc..

If you have any suggestions please open an issue, thanks!

Re: Show HN: SFTPGo 0.9.6

#7

Post by SteveNuts »

dillonmckay wrote: post #2

So, at my work, we host both SFTP and FTP to receive data feeds. Has anyone seen an FTP honeypot that would serve zip bombs to malicious users and allow legit users proper access?

I always worry that if I do something like this it'll cause the malicious person to spend extra effort and attention on a real attack.

Because that's what I'd do if I hit a honeypot...

Re: Show HN: SFTPGo 0.9.6

#8

Post by dillonmckay »

SteveNuts wrote: post #7
dillonmckay wrote: post #2

So, at my work, we host both SFTP and FTP to receive data feeds. Has anyone seen an FTP honeypot that would serve zip bombs to malicious users and allow legit users proper access?

I always worry that if I do something like this it'll cause the malicious person to spend extra effort and attention on a real attack. Because that's what I'd do if I hit a honeypot...

Fair point.

Re: Show HN: SFTPGo 0.9.6

#9

Post by yokohummer7 »

dang wrote: post #5

A thread on this project from last year: https://news.ycombinator.com/item?id=20531541 If you're going to make a Show HN out of a new release, it would be good to add a comment explaining what's different since last time!

How do you even remember a thread from last year? I'm always surprised by your vast knowledge required for moderation. Possibly with a help of some internal search tools?

Re: Show HN: SFTPGo 0.9.6

#10

Post by henriquez »

drakkan wrote: post #6
dang wrote: post #5

A thread on this project from last year: https://news.ycombinator.com/item?id=20531541 If you're going to make a Show HN out of a new release, it would be good to add a comment explaining what's different since last time!

Yes sorry, the project improved a lot since then, all the issues raised in that thread were addressed and several new features were added: we now support serving Cloud Storage backend (such as S3) over SFTP/SCP, multi factor authentication, virtual folders, several filters (for example on file extensions, on source ip address), external authentication, serving Git repos over SSH, per directory virtual permissions (no…

Congrats on the new release, that's some serious new functionality. This seems like a really useful project for cases where you wouldn't want to give a user SSH access into a particular server.

Thank you for releasing it as free software, I will be following this project for later use!

Post reply on HN