0

For my research I need some people to be able to connect to a webpage and upload their files anonymously. I have a Raspberry Pi 3b and it seemed a good opportunity to start playing with it a little bit. I have looked around a little for tutorials but found no exact answer to my specific need (here, here, here and here as well). In fact, I need the simplest (and safest) way to let people send files anonymously to me, possibly simply going on a web page with a regular browser and upload the file. Is there any noob-compatible way of doing this, knowing that my Pi is connected to University network, which could put some limitations?

Thank you!

Improve this question

1 Answer 1

Reset to default
0

i don't know how good your admin / webhosting skills are. I suppose as bad as mine. In that case i would not recommend to just install LAMP and bring your PI online. I suppose you will be hacked, sooner or later. The hole, "how to prevent hackers from hacking my machine" topic is way to huge, to understand it in a few days. I would suggest you to take a look at https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/ with his nice advertising video https://www.youtube.com/watch?v=Drj0VFhqSes

By using his Nextcloud Pi image you should be safer than creating your own secure machine, except you are an expert in this segment. Using Nextcloud, from a user-perspective, should also be pretty intuitive. The only problem I see, is that you will need to create accounts Usernames + Passwords to log in. If multiple people log in with the same credentials I guess they will be able to modify or delete files that other people uploaded.

Btw. my personal setup is the following: One Pi2 as OpenVPN server at home, behind a router. In my router i did forward the port needed for OpenVPN. If i want to upload, download, or ssh into any PC in my homenetwork I will create a connection via internet to the Pi2 OpenVPN server first. The vpn tunnel will allow me to access all services in my homenetwork as if I am at home. This setup allows me to be pretty safe against a lot of attacks because all my services are all unreachable from the internet. The only service that is directly reachable from the internet is the openvpn server (No Apache, No PhP, No MySQL, No SSH, No FTP, etc...). For this setup to work you would need to create keypairs and certificates and it might be pretty hard in explaining people how to connect. But once the connection is established, you can serve pretty much all services without taking too much care of security.

Improve this answer
3
  • Thank for the detailed reply! Well, your configuration seems to work well for your purpose, which is a longer term one than mine, I guess. I would like to be online asap and as safely as possible, so I guess I will end up writing down a html page to host the survey I need to disseminate (those were the files I was referring to in the question), put it up in the Pi and let it collect and store all the responses. Then the question would be how to set up a public web page on a Pi, but that's way off topic. I will nevertheless keep in mind you response when I'll try to set up a domestic server!
    – Ceschi
    Commented Jan 12, 2018 at 14:22
  • I would suggest you read a little bit about security and try to hardening your server from scratch. Most tutorials do not cover security at all. For SSH digitalocean.com/community/tutorials/how-to-set-up-ssh-keys--2 and fail2ban.org/wiki/index.php/Main_Page | for Apache2 tecmint.com/apache-security-tips | for MySQL dev.mysql.com/doc/mysql-security-excerpt/5.7/en/security.html (especially the installation procedure), and if you have some more time, check iptables guides
    – AlexOnLinux
    Commented Jan 12, 2018 at 16:15
  • for php blog.up-link.ro/… and do never ever trust userinput in your php scripts. Especially in a textform where the user is able to write. Those scripts tend to be an entry-point.
    – AlexOnLinux
    Commented Jan 12, 2018 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.