Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory.

I want to be able to share link with people i know, by creating a folder that look like this: 0gzzfiz4pf80mn8dw1k3

So my friend would go to www.mysite.com/0gzzfiz4pf80mn8dw1k3 and be able to download the files i have put in this folder.

Is this a secure way to share file?

I understand that someone could listen in but what i don't want is people browsing www.mysite.com and be able to get a listing of those special folder i created.

EDIT:

Ok, so you need to deactivate directoy listing and I would create a index.html file in that folder that redirect to the actual file i want to share with them. I am aware of the MITM problem, not really my concern here.

If I do deactivate directory listing, is there any other way other than brute-force to find my 0gzzfiz4pf80mn8dw1k3 folder?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

You can disable directory listing in Mongoose using the following:

./mongoose -d no      [ Runtime ]
d    no               [ Config File ]

But why not password protect the directory with a .htaccess file?

./mongoose -A ./.htpasswd localhost admin pass

You'd still be susceptible to a MITM attack, so use this with SSL. While this may be a simple, lightweight web server, something like a full blown Apache will be much more hardened against exploits.

share|improve this answer
    
I recommend password protecting as well because if your friend or anyone you are sharing these files with accesses another website directly after viewing your special page, it will be listed as the referrer in the logs of the destination site. I also have a sneaky suspicion that google crawls referral sites, which means your "secret" link could become indexed by google. –  k1DBLITZ Jan 31 '13 at 19:14
    
Wow @k1DBLITZ This would be bad indeed. But for this to be true it would only work if the next site my friend visit is google.com. Otherwise the site visited would get it in his log but google cant crawl each website log? –  Benoit Bourgault Jan 31 '13 at 22:22
    
That is correct. Your friend would have to directly visit Google after accessing your page. –  k1DBLITZ Jan 31 '13 at 22:28
    
So my only way to have 1 click links that are "safe" are to make those link 1-time use. TYVM @k1DBLITZ. –  Benoit Bourgault Feb 1 '13 at 18:48
add comment

The first paragraph of AJHenderson's answer is slightly misleading. It appears to suggest that it's up to the browser to refuse to view the default file and instead get a directory listing.

If it is a default file, then it will end up displaying by default in most browsers

That is incorrect. There's no browser that is able to force the web server to list the directory contents if the the directory is configured to server a default page

You do not have to explicitly configure your web server to prevent listing directories. It is enough to configure it to look for default files (usually index.html, index.php, default.html..) and serve them.

In HTTP there's no Show me teh directoryz plz request. If the web server is configured to serve index.html files by default then there's no way*, AFAIK, to list the files in the directory in which the index.html exist.

Other than that, both answers offer great security advices.


* Excluding bugs in the web server or brute-force/dictionary crawlers, like IntelliTamper.

share|improve this answer
    
Great thanks @adnan. Those are great points. –  Benoit Bourgault Feb 1 '13 at 21:21
add comment

Just to clarify on aus's answer. No, simply putting an index file is not sufficient to prevent directory browsing. If it is a default file, then it will end up displaying by default in most browsers, but you need to actually disable directory browsing as aus mentioned. Also, disabling directory browsing would prevent your friends from accessing the folder unless you turned on directory browsing for that folder particularly.

Password protected access or setting up FTP is the ideal way to handle this situation. You will also want to use SSL (even if just a self signed certificate) to protect the connection. If you self-sign, it will give a warning when your friends try to access it, but they can verify the fingerprint is your server's key and then manually trust the cert to avoid warnings in the future.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.