Thumbnail generation on remote server?

ThePromenader

Hello,

I seem to have programmed myself into a corner. I have a secure server (accessible only through sftp, no ssh shell) and a 'public' server accessible from the web. Should a visitor wish to see his/her content on the secure server, he has but to visit a page on the public server and enter his login/pass to establish an ssh connection to the secure server (I have doubts about how the password is sent to the secure server - I may have to use sftp - but this is secondary for now).

The thing is, I can pull the content off the secure server easily enough, but as much of that content will be images, I'm having problems on how to approach the problem of providing each (sometimes very large) image with a thumbnail. I cannot download the entire file to the public server, treat it with gd, and send it back! This would be a terrible waste of bandwidth.

Is there any way to activate a php script remotely - with php? I would like the remote server to do all the gd work - but how to get the script working with a 'jailed' sftp-filesystem connection only?

Thanks for any and all advice.

bpat1434

I'd wonder about your setup. 99% of web hosts will allow unlimited traffic between internal servers (i.e. server A in rack A to server B in rack K) because it doesn't hurt or cost them anything to allow that. So most good dedicated hosts will allow you to have unlimited bandwidth behind the main router (i.e. to internal servers) and limit only that data going through its main connection.

You can do a remote php call if you just call it via the IP address (assuming it's accessible) and it should run. Or you can put a light footprint http server on there and call it via that http server.

ThePromenader

Actually the servers are at two different locations. A client logging into the 'head' website server will pass his username/pass to a php script that will open an ssh connection to the second server (in a remote location) where he will be 'jailed' to his own folder (and sub-hierarchy should he care to create it).

I'm actually considering opening a connection directly to the secure server - not only because of the limitations the above configuration imposes (in spite of its security benifits). I also see a problem accessing php scripts that would be run as root, as well as the insecurity of sending a password 'in the clear' from a computer to a php script; even if the connection between the two servers is secure, the connection between the client and the first 'head' server is not. Perhaps https?

All the same, I don't want to open more ports on our secure server, especially web ports.

bpat1434

Well, you could symlink the php scripts that need to be run (or can be run) by the user and give everyone execute permissions on those files (not the symlinks).

You could use https; however, most places don't start https until after the login, so you could just use regular http and then when they login use https, or you could hash the password prior to post using some algorithm. Something similar to what vB does to protect plain-text passwords.