1

How to use curlftpfs, in a secure way? I mean without having FTP password in plaintext and world-readable.

I ask this because curlftpfs works running a command like that:

curlftpfs HOST /mnt/path -o user=USERNAME:PASSWORD

Unfortunately this has security concerns since your password will be shown in plaintext in the process list.

Moreover, if you want to mount the FTP directory at startup, you are tempted to use curlftpfs in /etc/fstab but I have to remember that this has security concerns too because that file usually is not designed to keep secrets since it's 660 or -rw-r--r-- so the last line in /etc/fstab will be world-readable:

/dev/mapper/centos-home           /home     xfs   defaults  0 0
/dev/mapper/centos-swap           swap      swap  defaults  0 0
curlftpfs#USERNAME:PASSWORD@HOST  /mnt/path fuse  rw,noauto 0 0

Additionally, the official manual (man 1 curlftpfs) does not describe any parameter to pass credentials in a different way and does not say much more. Moreover, somebody asked how to mount an FTP directory using curlftpfs but at the moment the answer says to put them in plaintext and world-readable (that as already said may be not good for you).

Additionally, the official manual says something about reading more details on another man page but at the moment that man page is not available in Centos 7. Maybe a documentation bug?

curlftpfs is powered by libcurl for all transfer-related features. See libcurl(3) for details. The filesystem part is implemented on top of FUSE. See http://fuse.sourceforge.net/ for details.

― From man 1 curlftpfs

But:

$ yum install -y libcurl
$ man libcurl
No manual entry for libcurl

In short.

How do people use curlftpfs safely (without plaintext and world-readable password) in whatever normal shared system?

Improve this question

1 Answer 1

Reset to default
1

I was able to create a file with the password. The file should be called .netrc and saved in the home of the user that will run the command (/root/.netrc). The content should be:

machine YOUR_HOSTNAME
login YOUR_USERNAME
password YOUR_PASSWORD

Example:

machine example.com
login foo
password secret

Then assign some permissions to that file, for example to avoid to be world-readable set this:

chmod 660 /root/.netrc

Now test your FTP connection omitting username and password. For example:

curlftpfs hostname /mnt/myplace

If it works, you can also write it in /etc/fstab omitting the password. For example:

/dev/mapper/centos-home  /home     xfs   defaults  0 0
/dev/mapper/centos-swap  swap      swap  defaults  0 0
curlftpfs#USERNAME@HOST  /mnt/path fuse  rw,noauto 0 0

Note that I was able to detect this feature only because I've read this misleading phrase in the official documentation:

Specify user and password to use for server authentication. Overrides netrc configuration.

― From man 1 curlftpfs

What is netrc? Why I should override it? Is this thing enabled as default? These questions have no answer in the documentation. Anyway yes, netrc it's enabled as default in curlftpfs and yes, you can learn more:

Improve this answer
1
  • 1
    netrc is traditionally used by the ftp tool, and should be documented either in the man 1 ftp manual page or info "(inetutils)The .netrc file" (depending on which 'ftp' client is installed), although the original documentation can be found in An Introduction to the Berkeley Network.
    – u1686_grawity
    Sep 21, 2021 at 11:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .