Sunday 24 October 2004

, , ,

FTP servers like granny used to make

This tutorial is dedicated to all you podcasters and other creative, digital artists wishing to share your original content with an adoring fan base. What better way to thank them for their unwavering adulation than to offer your personal hard drive on a silver platter? While actually giving away your physical drive would be a very friendly gesture, and one which I'm sure would be greatly appreciated, this isn't quite what I'm getting at. What I mean is you could freely allow the great unwashed to remotely connect to your computer and fill their virtual shopping baskets with your handicrafts. Although at first this may sound like a risky business, providing you use the right software and set up your server correctly, you need not worry about people gaining access to anything you don't want them to see. It's your server so you set the limits.

In this case the right software is a specialist application known as an FTP daemon - my personal favourite is Serv-U (other people prefer War FTP or Bullet Proof FTP Server, but they're all mad and aren't to be trusted). Once you have downloaded and installed the trial version of Serv-U, locate its shortcut in your start bar and run the program. As it loads you will be greeted by a status screen detailing the version number and copyright stipulations of the software. Of greater interest, in addition to this information you will find a reference to your IP address and port number. It is wise to keep a note of these details because without them you will not be able to tell people how to connect to your server. The fact that Serv-U has been able to identify your IP address indicates that your computer is online and is capable of accepting remote connections. Regardless, don't share those all important digits just yet - you have a few configuration settings to adjust first.

To get started, click on the 'setup' button, located in the menu bar of the program. When the list of options expands, scroll through them until you come to 'ftp server' and click on it to open the server setup dialog box. This is where you will be given the opportunity to assemble your FTP server exactly the way you want it. Some of these options you can leave alone, the port number for instance is best left set at 21 (the default setting for any FTP server). Other options that will require tweaking include the maximum speed at which users are allowed to download and the maximum number of users permitted to connect simultaneously. These options jointly allow you to tailor your server to the bandwidth capacity of your internet connection. You will have to consider this carefully. Obviously if you only have a 56k slowdom you won't want hundreds of people accessing your computer all at once; that would be a fruitless exercise for all concerned. On the other hand, a faster connection will allow you to offer access to many users simultaneously whilst maintaining a reasonable bandwidth to user ratio. A good rule of thumb is to consider the speed you would be happy downloading at, and subsequently adjust your settings accordingly.

The next thing you need to do is set the location of the text file you wish people to view whenever they connect to your computer. This should contain any information regarding server uptime/downtime, usernames and passwords, rules and regulations and so on. Finally it is a good idea to place some limits on the number of times a single user can attempt to make a connection to your computer within a delineated period of time. This will prevent people from 'hammering' your site in order to gain access as soon as another user logs off, freeing up one of your allocated slots.

That just about covers all the changes you will need to make in the 'setup server' menu, so click on the 'OK' button to return to the main menu. The next step involves setting up at least one username and password combination to be circulated amongst those people you intend to leave the welcome mat out for. To do this, click on the 'setup' button once again, but this time choose the 'users' option. Your first task is to enter a username and password in the... yes, you've guessed it, the boxes labelled 'username' and 'password'. These fields can consist of any characters you like, but bear in mind they are case sensitive. As such the password 'lemme-in' is not the equivalent of the password 'LeMme-in'.

At this juncture you will have to select a 'home' directory. This will be your user's first port of call once a connection to your computer has been established. Obviously it wouldn't be very wise to let any Tom, Dick or Harry have full control of your PC since they could wipe out your hard drive, delve into your private documents, upload viruses or, well, do anything they like really. For this reason I would strongly advise creating a new directory populated with only the files you wish remote users to have access to. For the sake of simplicity call this 'ftpserver' and enter it into the 'home directory' dialog box.

Your final obligation is to decide which permission attributes to associate with your directories - click on the 'add' button from within the 'file/directory access rules' area of the 'setup users' window and select the directory you chose as 'home' earlier. To complete the process you will now be required to put a tick in all the relevant boxes. In the directory you want people to be able to browse and download from it would make sense only to tick the 'read' box from the 'files' section, the 'list' box in the directories section and the 'inherit' box in the the 'sub dirs' section (this enables people to view the sub directories within your home folder). This ensures that people can download whatever they like, but cannot remove anything that is already there or add anything new. If you also want people to be able to upload files, you are best advised to create a new directory called 'uploads' and change the permission attributes accordingly. In this case you will need to tick the 'write' box in the 'files' area, the 'make' box in the 'directories' area and the 'inherit' box in the 'sub dirs' area (again so people aren't left fumbling in the dark).

You must now decide if you would like to use one configuration for all your users, or to give each individual user independent access rights. The process is identical no matter how many different username and password combinations you decide to setup, so if you wish to add more simply retrace the steps above until you're happy with your setup.

Sharing is the name of the game, so in typical Robin Hood fashion, all that remains to be done is to divulge your IP address to the rest of the world... or at the very least to a handful of carefully selected, trustworthy technophiles. No, don't mention it - everything I do, I do it for yoooooooou. I'd walk the wire for you, don't you know... whatever that means.

Sunday 17 October 2004

, , , , , , ,

Pop-ups - the uninvited guests of the web

You will soon discover that one of the main drawbacks of browsing the web is the spontaneous appearance of pop-ups. If you've been surfing the net for more than a day or two I'd hazard a guess that you've already been introduced to the exasperating world of pop-ups. I very much doubt you need me to provide you with a definition of a pop-up, but you never know so here goes. A pop-up is a web browser window containing a graphical advertisement which uninvitedly presents itself when you open a web page containing the necessary pop-up generating JavaScript code.

This is a brazen money making scheme; the idea being that by thrusting adverts under your unsuspecting nose, webmasters can earn money by conning you into clicking on links to commercial sites and subsequently encouraging you to buy whatever unmissable deal is on offer at the time. Very rarely are you taken to the site you were expecting to visit. Instead you are deliberately mislead, and more often than not, redirected to a subscription based porn site. The link you clicked on sends a message to the site that is being promoted and the details of the referrer are logged. Then at the end of the month the cretin who tricked you into visiting a site that you had no interest in receives a cheque for his trouble. Sound familiar? Well I think I've mentioned this once or twice before. Don't despair; you will be delighted to know that you don't have to put up with this intrusion. The 99.99% effective way to stop the evil blighters in their tracks is to install a web browser with a built-in pop-up disabling widget.

Before pop-ups became such a ubiquitous aspect of web life it was necessary to install a separate application in order stymy their untimely appearance. These are now superfluous seeing as all the most popular browsers come complete with an array of pop-up murderingly useful features designed to selectively filter the web content you view - to protect yourself, all you have to do is ensure that these are enabled.

If you insist on using Internet Explorer (otherwise known as the malware magnet) you can do this by clicking on the "turn on pop-up blocker" option found within the 'tools' menu. In Mozilla-based browsers e.g. Firefox, the pop-up blocker can be switched on by ticking the "block unrequested pop-ups" check box located under the 'privacy and security' tab of the 'preferences' panel (which in turn can be accessed via the 'edit' drop-down menu). Additionally both browsers support pop-up 'white lists' that allow you to specify which sites are to be trusted to launch pop-ups. This comes in very handy for those odd occasions when you actually want pop-ups to do what they do best, pop up that is. Many benign sites are rendered inoperable if they are restricted by pop-up blockers so this is crucial.

Even if a site hasn't been added to your white list, it is usually possible to give it the green light on a one-off basis by holding down a 'hot key' (control in IE) as the site loads. Some pop-up blocking tools can be set to either flash in your task tray or status bar, play a sound or do both each time they zap a pop-up dead in the water. Give it a try - you won't realise how satisfying a flashing icon can be until you visit a pop-up laden web site!

Take a last long look at that pop-up loitering menacingly on your screen. Now you have your pop-up blocker enabled it will be the last one you will ever see!

Friday 15 October 2004

, , , , ,

Malware; the scourge of the web

I'll be visiting a web site when all of a sudden lots of links will magically appear in my favourites list and my home page and default search engine are changed without so much as a word of notification or a request to do so. I'm a sitting duck. Is there anything I can do to protect myself from this invasion of privacy?

These browser hijack attempts are orchestrated by a variety of malicious software (aka malware) built into, mostly seedy, web sites by unscrupulous webmasters. The majority of virus-like malware finds its way onto your system via Internet Explorer's reckless and highly vulnerable Active-X and Active Scripting components - two technologies designed to allow web sites to make high-level changes to your system upon your request - think of Microsoft's Windows Update protocol and online virus scanners, for instance.

Giving legitimate web sites the go ahead to alter your operating system is more than likely to be in your best interests. Your problems start, however, when less trustworthy individuals adopt the same technology to exploit your system for their own devious ends - to bully you into visiting shopping sites they are affiliated with, to monitor your activities for market research purposes, to unleash viruses and trojans upon your system, and so on.

Only Internet Explorer provides support for the insanely invasive components which make it easy for these cyber reprobates to cause your system serious harm - one of the many reasons you should ditch it this instant in favour of a more secure browser such as Mozilla Firefox or Opera!

Aside from switching browsers, these kind of exploits can be suppressed before they are able to embed themselves into your system by enabling the active protection features of your anti-virus software - that is providing you remember to keep its engine and virus definitions up to date!

No matter which browser or operating system you are running, it is also essential that you keep them both up to date by installing all service packs and bug fixes made available by their manufacturers. The vast majority of the changes made to operating systems and browsers when they are updated comprise behind the scenes security fixes, which can help to block off any loop holes that shifty webmasters can use to take advantage of anyone unlucky enough to stumble upon one of their sites.

If your system has already fallen victim to such exploits, you can often decontaminate it using a spyware/malware eliminator such as Ad-Aware or Spybot Search and Destroy. Much like the active protection components of anti-virus software, these tools often make use of preventative mechanisms to help you avoid contracting all manner of web nasties in the first place.

Better still, switch to the Mac platform! Malware is specifically a Windows issue - you can obviate its strangle hold entirely by abandoning this sinking ship.