> FTP is
pretty much the best example I can think of if you wanted me
> to name a massive security hole.
Depends on the ftp server you use, and how
it's configured. chroot
is your friend here, though not your only friend.
Agreed. I've run ftp.rodents.montreal.qc.ca for years, and haven't
seen any problems I can attribute to its FTP daemon.
The other
problem with FTP for this sort of thing is that it often
interacts badly with NAT and firewalling (at both ends of the
connection).
Allowing for passive ftp is one way to fix this.
Passive FTP doesn't actually _fix_ anything; it just papers over the
symptom, and that only for cases where the NAT in question is fronting
for the FTP client. NAT fronting for the FTP server similarly
"compels" non-passive data connections. (Put NAT on each end, and FTP
just plain doesn't work.)
Like most cases where NAT interferes with something, my recommendation
here is to get rid of the NAT. It breaks the fundamental assumptions
underlying IP-based networking, and it's a tribute to the robustness of
the protocols involved that breakage symptoms are as rare as they are.
However, there's nothing wrong with putting this
stuff on a web
server instead, which makes life a lot easier for everything except
the "grab this entire directory" option - but for that, there's
always wget.
wget doesn't help, really, because the problem is not the fetching; the
problem is finding out what's in "this entire directory". HTTP is not
intended as a general-purpose file transfer protocol, so it's no
surprise it is a poor fit to the task. FTP, on the other hand, is
designed as, well, a File Transfer Protocol, and it does it well.
Of course, that's not to say that either can't be pressed into service
in place of the other; my own FTP area is also served up via HTTP....
/~\ The ASCII der Mouse
\ / Ribbon Campaign
X Against HTML mouse at rodents.montreal.qc.ca
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B