FTP, SFTP or other? Secure transmission protocol usable through browser

Question

I'm looking for a secure transmission protocol that can be accessed through the web browser. The user should be able only to access/modify only some folder, not the whole filesystem.

For example I'd like to access to my server visiting a link of this kind:

ftp://mysite.com

Unfortunately ftp is not secure at all and sounds a bit anachronistic in 2017.

SFTP has three problem:

1. I cannot access through browser from a Mac PC (I need a software like filezilla).
2. With the same credential I can access through SSH to the terminal.
3. I cannot restrict the accessible directory.

Do you have any suggestion to achieve what I want? I've raspbian on a raspberry pi 3 and the service that I want to create for the moment is restricted to a limited number of people, so I cannot effort to purchase certificates, external server or proprietary solution.

I know that exist also FTPS and FTP over SSH but I really don't know if these are the best and easiest solution

Answer 1

You can configure Apache or NGINX for WebDAV, which allows files uploads as well. I recommend you use TLS with authentication (digest or plain) for uploading.

You can also set up web server for file download and do uploading using SFTP. You can restrict specific user/group to sftp (no shell) and chroot (limited filesystem tree) by customizing your sshd_config. Wikibooks has some example configurations.