is that a good offer for a server installation?

A person I know needs to receive large files (about 500 Mb) from his
customers to be downloaded and then worked.
Each customer should have his own protected area.
He has contacted a computer company (moreover distant more than 100 km from
his office) that has proposed this solution:
1. buying a server to mantain in his office
2. SO linux based upon kernel 2.6xx
3. web server&php. apache
4. firewall
5. installation of cwfm (a software that manages files, at first I believed
that should be created by them, but then I found out to be free on the net
http://cwfm.sourceforge.net) upload and download are managed via http

The economic offer was:
- installation SO linux: configuration linux, apache, php, dns, iptables and
cwfm --->3000 euro (about 3600 dollars)
- mantainance ---> first year free, from the second on 1000 euro (about 1200
dollars)
purchasing of the server is apart

I'm very doubfull about this, but the person who should buy everything is
even enthustiastic about the onesty and knoledge of these people.

They insisted above all on the issue of security, as if hackers ordinary
waste their time to manage to keep wedding albums sent via the internt, and
they told him that ftp is not secure for this and their program is based
upon http. "It could be seriously risky for his customer privacy" !!!

questions:
1) do you relly think that http is more secure than ftp?
2) do you think http is the right solution for uploading so large files?
3) what do you think about the economic offer? Consider that I' writing from
Italy and here everything is cheaper compared to, for example USA or
northern europe. So you have to consider higher the sum he has to pay.

Has somebody some link to correlated topics? As it seems that I have no
authority with this person, wich insted should have a site with articles
written by knoledged people. I've made a search on the internt but I was non
able to find anything usefull.


bye and thank you to those who will express an opinion



Giuseppe

Giuseppe wrote:

> 1) do you relly think that http is more secure than ftp?

The security problems with ftp are a result of the ID and passwords being
sent in clear text. An http server can use https, which encrypts the data,
so that ID, password and everything else is protected.

> 2) do you think http is the right solution for uploading so large files?
Given that's what most of the net uses, yes. Other solutions are scp
(secure copy)and sftp (secure ftp). Ftp is fine for anonymous downloads.

"James Knott" ha scritto nel messaggio
> > 2) do you think http is the right solution for uploading so large files?
> Given that's what most of the net uses, yes.

I did not think that most of the net use http for large files, and I'm still
surprised :-()

Anyway, thank you

In comp.os.linux.networking Giuseppe <(E-Mail Removed)>:
> A person I know needs to receive large files (about 500 Mb) from his
> customers to be downloaded and then worked.
> Each customer should have his own protected area.
> He has contacted a computer company (moreover distant more than 100 km from
> his office) that has proposed this solution:
> 1. buying a server to mantain in his office
> 2. SO linux based upon kernel 2.6xx
> 3. web server&php. apache
> 4. firewall
> 5. installation of cwfm (a software that manages files, at first I believed
> that should be created by them, but then I found out to be free on the net
> http://cwfm.sourceforge.net) upload and download are managed via http

> The economic offer was:
> - installation SO linux: configuration linux, apache, php, dns, iptables and
> cwfm --->3000 euro (about 3600 dollars)

If I'd got that for any Linux system setup by me, man I'd be
rich.

> - mantainance ---> first year free, from the second on 1000 euro (about 1200
> dollars)
> purchasing of the server is apart
[..]

> questions:
> 1) do you relly think that http is more secure than ftp?

If you'd use the complete upload service with https for sure,
http itself has no more security then ftp (user/password) travel
in clear text over th internet. At least there are far less
security exploits against http server then ftp, but that's all.

> 2) do you think http is the right solution for uploading so large files?

Should be no big problem, even if ftp with the proper
server/client combination allows resuming uploads, a big pro.
Never heard you could do this with http upload, but I might be
wrong.

> 3) what do you think about the economic offer? Consider that I' writing from
> Italy and here everything is cheaper compared to, for example USA or
> northern europe. So you have to consider higher the sum he has to pay.

Can't say much, is this including hardware support? What response
times? What service times, 24/7? Any availability/SLA guarantees?

You could ask the company for references and try calling some of
them and ask how satisfied they are with the service.

> Has somebody some link to correlated topics? As it seems that I have no
> authority with this person, wich insted should have a site with articles
> written by knoledged people. I've made a search on the internt but I was non
> able to find anything usefull.

Hire someone who has a clue?

Good luck

--
Michael Heiming (X-PGP-Sig > GPG-Key ID: EDD27B94)
mail: echo (E-Mail Removed) | perl -pe 'y/a-z/n-za-m/'
#bofh excuse 286: Telecommunications is downgrading.

Giuseppe wrote:

> "James Knott" ha scritto nel messaggio
>> > 2) do you think http is the right solution for uploading so large
>> > files?
>> Given that's what most of the net uses, yes.
>
> I did not think that most of the net use http for large files, and I'm
> still surprised :-()
>
> Anyway, thank you

Perhaps you should be asking why not use it for large files. If you can't
come up with valid reasons, maybe there are none.

"James Knott" ha scritto nel messaggio
> Perhaps you should be asking why not use it for large files. If you can't
> come up with valid reasons, maybe there are none.


I've read that HTTP uploads cannot be resumed, and when a connection fails
half way through an upload he has to start over from the beginning.
Is it true?
bye

Michael Heiming wrote:
> Hire someone who has a clue?

I second that.

For files that big, I'd use rsync over ssh or openvpn....

http cannot resume, and the likelihood of a broken connection is high....

Giuseppe wrote:

<snip>
>
> questions:
> 1) do you relly think that http is more secure than ftp?
NO, try using SFTP or using a tunnel for FTP
> 2) do you think http is the right solution for uploading so large files?
NO
> 3) what do you think about the economic offer? Consider that I' writing from
> Italy and here everything is cheaper compared to, for example USA or
> northern europe. So you have to consider higher the sum he has to pay.
I think if you shop around you will find better pricing.
>
> Has somebody some link to correlated topics? As it seems that I have no
> authority with this person, wich insted should have a site with articles
> written by knoledged people. I've made a search on the internt but I was non
> able to find anything usefull.
>
>
> bye and thank you to those who will express an opinion
>
>
>
> Giuseppe
>
>
>
>
>
>
>
>