Protecting certain FTP Files

**Ty44ler** · May 19th, 2009, 11:22 AM

I'm a web developer for a construction contracting company and they have me working on a website that shows all their clients files so each client can find their project and view its blueprints etc. It's basically just so that the clients have an easier interface to deal with rather than trying to find their files through the online FTP service.

Some of those files are government files and need to be protected somehow so that not everyone can view them. How would you go about protecting those files?

Thanks in advance!

**Nude_Lewd_Man** · May 19th, 2009, 11:32 AM

I'm not entirely au fait with the web-FTP thing, but I know that if you're doing it from a server, then you need to create separate accounts and passwords for each user (or set thereof) to have separate permissions to...

**GroundZero3** · May 19th, 2009, 11:33 AM

Premissions on user accounts assign to folders would be your best bet

**Nude_Lewd_Man** · May 19th, 2009, 11:48 AM

GZ,

I'm not 100% sure that the Ty44ler is going to be doing this on a domain/AD server, but on a web-server somewhere out there on t'interwebbe.... In which case, I'm not so sure that they'd be able to set that sort of permissions.....

**Nude_Lewd_Man** · May 19th, 2009, 11:50 AM

[Thinking about it, this is exactly what I'm looking to do for a site I'm supposed to be sorting out for my Mum's golfist buddies......which I passed on to my friendly French web page maker...]

**GroundZero3** · May 19th, 2009, 11:54 AM

Most decent ftp servers have the abilities to setup groups, users and permissions.

*edited I think I misread. More information on the server/application/setup is needed!

**Ty44ler** · May 19th, 2009, 01:37 PM

yeah, the files are stored online through drivehq.com, I've never heard of them before I started working on this...

I was thinking if I made links for each file on the pages, I could have it so a password must be entered after the link is clicked to access the file? does that sound feasible? Would that even be very secure?

I'm not entirely comfortable with javascript or the sort if that would be one of the only ways it could be done.

**EXreaction** · May 19th, 2009, 01:42 PM

Just setup a basic login page and list the files their accounts have access to. You'd need PHP or some scripting language and a database to store sessions/permissions.

If you need it to be secure you will need your own dedicated server for this. You can not be storing files on some 3rd parties server.

**Ty44ler** · May 26th, 2009, 11:55 AM

thanks for the replies everyone.

We set up our own serving using Apache then used .htaccess and .htpasswd to protect the files within the server once accessed. Works like a charm!