I'd like to add a really simple local FTP server to my FreeBSD system, to allow guests to do wifi speed testing.

Because of the use, I don't need more than very basic functionality - anon R/W to a specific IP address/port is about all. But it needs to be secure - no escaping! - because it's open by design to anyone able to connect to the WiFi.

If it helps, I have the option to install on a full FreeBSD system, or ideally on my OPNsense system itself, which controls the WiFi (OPNsense is a very similar fork of pfSense so pfSense-fu will probably apply). They all use FreeBSD or a hardened variant of it as base OS.

I haven't manually configured a jail or chroot before, so I don't want to make mistakes by overlooking anything.

What is the easiest way I could achieve this?

Update - HTTP/web, vs FTP?

I originally asked about ftp, because it seemed simpler and less that could go wrong or allow escape. The more complex a software is, the more surface for bugs/errors/insecurity/config oversights it can have, and web servers must be far more complex than ftp servers!

I also figured that an ftp server probably has lower resource use, as it'll be idle 99.999% of the time, and maybe more efficient when used (again less it needs to check), and as all I want is raw maximum throughout, the less it has to be configured for balancing different uses or engines, the better.

The only advantages might be - (1) an ftp speed checker needs the full file uri entered manually rather than just the web UI's IP; (2) it allows testing via JavaScript/iperf3 back end, or other diskless methods which could have advantages, such as reporting on latency or small/large file speeds.

I don't need a fancy interface (though "something nice" won't hurt) and I want to keep it really simple, ideally one service, one config file/rc setup, and if I used http, a single static top level web page + target file. Really simple, manually set up not a full downloaded "project". It just won't be used often enough for that. It'll mainly be used to check from time to time, how guest device reception is in different areas, and how the WiFi is handling power/channel regulations + contention, if someones device seems to be running slow, to see if its ok or if we need to revisit channel setup.

  • 1
    Why FTP? Not the best protocol to left open. in the past I used a shareware from "speedtest" to offer speedtest browser tests in my network via browser, but I think they killed it as it was based on Flash. There are other projects out there offering similar tests. – Rui F Ribeiro Feb 3 at 10:54
  • It probably wouldn't add enough to be worth it, and brings risks I don't need. To run that way, I'd have to configure and secure an entire web server, which sounds like a bigger and less certain job than just a simple ftp server. Modern browsers can access ftp:// URIs just as easily as http:// ones, and I don't know if the web server is as efficient/low resource use either. I've updated the OP with thoughts on this excellent comment. – Stilez Feb 3 at 11:15
  • You have very low profile http servers, after all you just serve files. There is lighthttpd, but I do believe you can even get lighter than that. Not sure if khttpd still works in recent kernel versions. – Rui F Ribeiro Feb 3 at 11:18
  • Okay, ill think on that point. But either way, the core of the question isn't "which ftp/http server" but "how to really secure whatever I decide on, properly, for safe anon wifi access, so it can't be escaped from"... – Stilez Feb 3 at 11:22
  • 1
    Do you really need to provide account-less write access? – JdeBP Feb 3 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.