Upload choices ftp security

[lcramer53]

1- My apologies if this post is in the wrong area or not conducive to this thread. (Had it in 'software' moving it here) anyway I am a kind of long time member and know that there are gurus here, hoping one of you can help me.

2- My issue: I created a website (for family and close friends) to do minor photo retouching/restoration (this is a hobby for me)

3- Restored a couple photos for a close friend, who then suggested my site to a not-so-close friend of hers

4- Received an email from the not-so-close-friend-of-my-friend to do some work

5- THIS, I THINK, is my mistake:
I created an ftp account at my server (Linux based) and instructed this individual with screen shots on how to install and operate the ftp client
6- Through my Cpanel, have been watching my bandwith... etc., (bandwith's ok) but noticed today (after I cancelled her account because of being told that she needs to find someone local to do her photos) that she had been at my site, every page, through the identity assigned her ftp account and instead of my cpanel indicating her ip address, it displayed the ftp account id. Is this strange? Should I be concerned? If so, of what should I be concerned?

7- I just want to do this as a hobby for family and close friends, but I still want to be secure.

I'm looking into a php script/form instead of creating an ftp account for family and friends. Is this a safer option?

I'm curious and perhaps my lack of knowledge is dangerous, kind of like, "..just enough rope to hang myself..".

Help, suggestions, tremendously appreciated.

Thanks!
__________________
Susie~
A candle loses nothing by lighting another candle.

[TommyO]

Although a bit hard to follow, it sounds like you should do a better job of creating a sound folder structure, user groups and then assigning rights to those groups and folders. All this needs to be figured out before handing out ftp accounts.

Regarding the other question on scripting... users do not need ftp to move images to and from your site. Scripting could be used, but if your really getting into having a lot of friends or family do this, I would look for a small software suite to do it all for you. There are many out there. You'll need to get some feedback from the group here.

[Doug Nelson]

If you created the FTP account via cpanel, it should have created a folder just for that one account. FTP users cannot "break out" of the folder they're landed in, unless you have the folder above it set at 777.

I'd suggest becoming familiar with site permissions, etc., before installing any scripts.

[lcramer53]

Tommy - I created her folder outside of my www folder because I had read somewhere to NOT create it in there. I did limit the permissions on the folder I had created. This morning, I re-created the account with a different password just to verify the access limitations when logged in to the ftp account. When I logged in, as this user would have, I could not access any other folder and was restricted to the assigned folder only.

Doug, I feel much relieved with your comment, "..users cannot "break out" of the folder they're landed in, unless you have the folder above it set at 777.." because I did not set the permissions to 777.

Thank you again!

[Vernon]

As Doug stated, upon creation of the ftp account through cpanel a folder is created and the account user may access only that account.

I've done something similar with regard to setting up a family-friends resource where they may upload images and later download teh retouched/enhanced versions, etc.

My approach was through the use of Gallery 2
It is a php-based script that can be uploaded to your site, and accessed via a link, or even integrated into your main web site.

Visit the link provided above for a well rounded introduction to the gallery and what you can do with it.

The developers have created a fairly easy add-on module that your "users" can install on their computers, and upload directly to your gallery using their access, etc.

Many of my family and friends who are not computer savvy have come to really like this method for uploading images.

[lcramer53]

Vernon, Gallery2 looks just like what I need! Thank you so much!