script that runs before being able to upload file to FTP

Question

I'm trying to create a security mechanism that only allows my application to upload files to my FTP (username and password login is not enough). To achieve this I was thinking of creating a key that is built in to the app, and before any file can be uploaded to the FTP this key has to be read and verified. If it's correct, then the file can be uploaded.

Is this something that is possible to do, and would this approach be preferred? Does anyone have any pointers on how to do this?

(note: i'm not asking for any code, just some pointers on where to start, since my searches aren't getting my anywhere)

Thanks.

Using a special Handshake system would be good. Hard-coding keys into your app is not a good idea. I myself am trying to find a way to secure my proprietary server from being accessed by code copied from my open source client. — A Person
– A Person, Commented Aug 10, 2012 at 13:05
@ChristerWilliamPersson OK, that won't work then. Do you mean FTP or HTTP? You can't run PHP on android, and running a PHP driven FTP server sounds like a bad plan. Implementing the app key/handshake system is a lot easier over HTTP than it would be over FTP — DaveRandom
– DaveRandom, Commented Aug 10, 2012 at 13:16
Yes, I'm thinking an HTTP POST with a file upload, and a couple of extra form fields can be used to implement some kind of app key setup. Before we go down that road though, you need to think about exactly what this extra auth token system will do, how it will work, how it can be validated on the server side etc. Do you want a hard-coded app key for every instance of your application? Hang on a second this is triggering a memory of another question I answered quite recently, let me dig it out... — DaveRandom
– DaveRandom, Commented Aug 10, 2012 at 13:41

Urlax · Accepted Answer · 2012-08-10 13:12:24Z

1

if you are worried about unsecured wi-fi, etc, you can either use SFTP or tunneling over SSH e.g. with connectbot the use of public key crypto will will make sniffing harder.

if this is too much work for the intended userbase, you could generate one time passes (like google authenticator) and upload your file with a POST form or something.

if you are afraid of the key itself getting stolen (compromised device), there is little you can do..

answered Aug 10, 2012 at 13:12

Urlax

212 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

2 revs · Accepted Answer · 2017-05-23 12:10:28Z

0

There's no point in reproducing an answer from another question verbatim, so I'll just post this link to it.

edited May 23, 2017 at 12:10

community wiki

2 revs
DaveRandom

Collectives™ on Stack Overflow

script that runs before being able to upload file to FTP

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related