I want to transfer files between to machines over the internet, in a SECURE way. Both machines have linux (the "server" uses Ubuntu 12 and the "client" uses Mint 14). I DO NOT want to allow ssh to my server, and i want the client to be able to open and read files on server, but it cannot modify/erase things. It's allowed to client copy files to server [or create files there] and copy from server.

I want to share just some directories in my server in the way above explained. Finally, i want to access files in the client in a easy fashion, like GUI mode or something..not using shell, but instead using a windows-like style (like if my remote folder is a local one, but with restrict access as above explained).

Being secure to me means that the connection must be encrypted, and the login could use some private/public key scheme.

What's the best solution for me ? I'm trying to find some SFTP configuration that fits my "specification", but the restriction in access is too "peculiar"...i don't know even if SFTP works without allowing ssh.

Thanks very much for any help...

EDIT: Thanks very very much for your help. I really appreciate this! I will evaluate all answers and try to figure out the best solution. By now, i think creating an user that have restricted access/privileges and allowing ONLY this user to do a SSH/SFTP ultra-secured is the best way..."hacks" to avoid ssh really can make things worse (less-secure). My question is a little bit confusing because my "logic" was a little disturbed. Now i can see more clearly...

  • Did you consider sftp? Ok sorry site-to-stie VPN then. – Danila Ladner May 7 '13 at 18:55
  • 1
    I want a pony but you can't always get what you want - how about a VPN and some permissions? – Chopper3 May 7 '13 at 19:00
  • 2
    VPN seems like the only sane option here based on what I'm reading but my question is why are you opposed to ssh? It's pretty solid and secure when set up correctly. You can use denyhosts, lock it down a million ways, change default port etc. – egorgry May 7 '13 at 19:05
  • 2
    If you could explain your aversion to ssh, it may make it easier to suggest an alternative, but ssh and rsync are likely to be the best possible solution here. – Johnsyweb May 7 '13 at 19:11
  • 1
    The question is confusing. Just a tiny bit of research would find that SCP and SFTP are SSH-based programs. Yet your question asks how to "transfer without SSH", and at the same time you say that you are trying to find an SFTP configuration. – ZaSter May 7 '13 at 19:58

The good old File Transfer Protocol (FTP) was invented for transferring files. To use it in a secure way, you can use ftps (which is not sftp, but ftp over ssl) or set up a vpn connection for security.

When I search for vsftpd+ssl, this is the first result which seems like a reasonable starting point.


You could setup a WebDAV file system over SSL.

  • Isn't webdav an extension of the HTTP protocol? So files on the disk will be owned by webserver user? – Danila Ladner May 7 '13 at 19:15

You can use any protocol, even unencrypted and without authentication. All you have to to is to sign and encrypt your data before you send it:

gpg --armor --local-user senderkey --recipient recipientkey --sign --encrypt cleartextfile

If you are paranoid about login possibilities on the target you can use a combination of

  1. some network event (that does not open a connection) which is logged by Netfilter (iptables)
  2. a wget call which is triggered by the logging and gets the file from some web server (the OpenPGP file probably needs to always have the same name then)

The following is simple and awesome:

python -m SimpleHTTPServer 8888

This starts a new http file server for current directory. Supposed there is a file named foo in current directory, you can download it like this:

wget http://your.ip.here:8888/foo

Try WebDAV. It's my favourite protocol for accessing files on my NAS.


Seems to me you should be able to restrict the user to just sftp by adding a command="..." directive to the users authorized_keys file. We're doing that at $work to restrict some user accounts to just rsync.

There's a wite-up at http://troy.jdmz.net/rsync/index.html that lays out the process for rsync.


"Is there a way to limit the SSH access on my server, and then only my client could do ssh/sftp into it?"

Sure. A strong password/passphrase or key-based authentication would suffice for this. If you want to further indulge your paranoia, firewall off port 22 except for the IPs that should have access, or add Google Authenticator's one-time-password PAM module for two-factor authentication.

As the industry's gold standard for remote access to servers, properly secured SSH is going to be a lot more secure than a hacky workaround based on the sole requirement of "no SSH".


You can use HTTPS protocol. This is simple installation for nginx.

apt install nginx
cd /etc/nginx/ ; openssl req -x509 -newkey rsa:2048 -keyout site.key -out site.crt -days 365 -nodes

vim /etc/nginx/sites-enabled/default 
server {
    listen 443 ssl default_server;
    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;
    ssl_certificate     site.crt;
        ssl_certificate_key site.key;
    server_name _;
    location / {
        try_files $uri $uri/ =404;


After this copy your files to /var/www/html, and download it from server. If you want close access for user use basic auth. If you want to upload files you can create simple PHP-script for it.

Your Answer

