PCR's notepad » FTP

Preventing FileZilla’s quickconnect from saving your passwords

David Dernoncourt — Wed, 03 Feb 2010 11:06:11 +0000

I recently started to see if I could use Portable FileZilla as an emergency FTP client in case something goes wrong on wiki4games or patheticcockroach.com. With this I could notably use the FTP even from work, if needed. But while testing, I found a little issue: the quickbar doesn’t have an option not to save the password. And I’d prefer to use the quickconnect bar because I don’t want save my accounts on the portable version so it’s quite faster than using the Site Manager every time.

I suppose you’re thinking:

If I clear the quickconnect bar every time, what’s the problem with it saving the passwords? => Well, what if I forget to clear the quickconnect bar?
The quickconnect bar doesn’t save the password if you don’t type it in the bar (source: comment by Denis “If you don’t enter a password in the “Quickconnect” bar, FileZilla will ask for the password when you connect. But in this case, the password won’t be saved [...]“), so just don’t type the password in the bar. => Well, what if I accidentally enter it anyway?

As you can see, the risks are low but they do exist: all is set up as if it was conceived just in the purpose of getting you to make a mistake (no confirmation when saving the password, need to clear manually on exit). But fortunately, the FileZilla crew provided us with a solution a while ago: the “Kiosk mode”. Introduced in version 3.1.2-rc1 (2008-08-24), it will prevent FileZilla from writing any passwords to the disk if set to 1. It was updated in version 3.2.3 (2009-03-21) with a new possible value of 2 which prevents FileZilla from writing to any settings files. To configure the Kiosk mode, add 2 withing the Settings block in fzdefaults.xml (in FileZilla Portable, this file is located in App/filezilla).
Beware: setting the Kiosk mode to 1 or 2 will not clear existing passwords, it will just prevent FileZilla from saving new passwords. To remove already saved password you need to do this manually (just clear the quickconnect bar).

Sources:

Creating an anonymous FTP with ProFTPd

David Dernoncourt — Mon, 13 Apr 2009 06:32:41 +0000

I’m just posting this as a back up, in fact. This configuration snippet can be used to create an anonymous FTP with read-only privilege in ProFTPd:
##Anonymous for etfiles downloads User www-data Group nogroup # UserAlias -- Alias a username to a system user UserAlias anonymous www-data AllowAll # Cosmetic changes, all files belongs to ftp user #DirFakeUser on ftp #DirFakeGroup on ftp


   RequireValidShell		off
   # Limit the maximum number of anonymous logins

   MaxClients			30
   # We want 'welcome.msg' displayed at login, and '.message' displayed

   # in each newly chdired directory.

   DisplayLogin			welcome.msg

   DisplayFirstChdir		.message

# Limit WRITE everywhere in the anonymous chroot DenyAll AllowAll

Also, adding the following is necessary to prevent the anonymous user from browsing the whole computer:
DefaultRoot ~

Show hidden files with ProFTPD

David Dernoncourt — Thu, 08 Jan 2009 18:56:15 +0000

I used to have no problem displaying hidden files (more precisely, my .htaccesss files) using FileZilla client with ProFTPD, but for some reason suddenly they disappeared… Adding (or editing) the following option in /etc/proftpd/proftpd.conf fixed this:

ListOptions “-a”

(actually I used ListOptions “-al” because the default behavior was -l, which is quite useful to me)