HOW-TO: SFTP support in ProFTPD

**rootbsd** · 04-18-2009, 04:13 PM

Updated Dec 2, 2010

We all know plain FTP is insecure and its surprising how much it is still in use today.

DA comes with support for ProFTPD mod_tls however there are several problems with mod_tls. 1) It only encrypts the control channel of FTP, leaving the actual data transferred still in clear text. 2) That also causes problems with FTP traversal of firewalls since the firewall can't see which ports are going to be needed, although that can be worked around with PassivePorts configuration in ProFTPD. 3) FTP/TLS support is also less common in FTP clients.

I'm sure some here have been using SFTP with DirectAdmin however that is done over the system's SSH daemon. The problems with this are 1) users must be given ssh access to use SFTP. 2) You can't restrict SSH access to certain IPs if you have customers needing to use SFTP. 3) It only lets DirectAdmin Users login, if a user creates a child FTP account, it will not work for SFTP.

SFTP hasn't been supported by many common FTP servers such as ProFTPD, until TJ Saunders wrote a mod_sftp for ProFTPD. I've set it up for several people recently and it works really well. It addresses all of the above problems.

The only drawback to this implementation is that all users on the system will need to switch to SFTP. I might try to come up with a setup for running both SFTP and insecure-FTP later if there is demand.

Step 1. Change your ssh port (optional)

I recommend changing your ssh port if you haven't done so already. This is done by changing the Port line in /etc/ssh/sshd_config and restarting sshd. Make sure you know what you are doing before attempting this, since you could lock yourself out of the server.

Step 2. Compile new ProFTPD with mod_sftp instead of mod_tls

Assuming your system has custombuild already installed. If you don't have custombuild, go here to install it.

Code:

cd /usr/local/directadmin/custombuild
./build update
perl -pi -e 's/proftpd=no/proftpd=yes/g' options.conf
mkdir -p custom/proftpd
cp configure/proftpd/configure.proftpd custom/proftpd/configure.proftpd
perl -pi -e 's/mod_tls/mod_sftp/g' custom/proftpd/configure.proftpd
./build proftpd

Step 3. Make sure new ProFTPD is working

Restart proftpd, Linux:

Code:

 service proftpd restart

FreeBSD:

Code:

 /usr/local/etc/rc.d/proftpd restart

Make sure you can still connect to your FTP server. You should see version 1.3.3e:

Code:

# ftp myserver.com
Connected to myserver.com (208.86.x.x).
220 ProFTPD 1.3.3e Server ready.
Name (myserver.com):

Step 4a. Change Port in ProFTPD

Open /etc/proftpd.conf in an editor and change the Port to what you want SFTP to use. To make it easy on your users you could use Port 22 since it would be the default in SFTP clients. You could also pick something random such as 3822.

Code:

Port                                 22

Step 4b. Enable SFTP in main proftpd.conf

Add the following lines to your /etc/proftpd.conf file, somewhere near the top of the file so its easy to find:

Code:

##
## SFTP Config
SFTPEngine      On
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_dsa_key
SFTPClientMatch "WS_FTP" channelWindowSize 1GB
# enable for sftp debugging:
#TraceLog /var/log/proftpd/sftp-trace.log
#Trace scp:20 sftp:20 ssh2:20
## End SFTP Config
##

COMMENT OUT the 'bytes' log in /etc/proftpd.conf as well:

Code:

#ExtendedLog            /var/log/proftpd/1.2.3.4.bytes WRITE,READ userlog

Step 4c. Enable SFTP in IP-based FTP vhosts

Add the following lines into EACH VirtualHost container in /etc/proftpd.vhosts.conf:

Code:

SFTPEngine      On
Port            22
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_dsa_key

The Port should match what you used in Step 4a. Make sure you put these 4 new lines before EACH </VirtualHost> in that file.

ALSO COMMENT OUT the bytes log in each VirtualHost entry

Step 4d. Enable SFTP config in FTP vhost template

Open up /usr/local/directadmin/data/templates/custom/proftpd.vhosts.conf in an editor. This should be a new file that you don't currently have, paste in:

Code:

<VirtualHost |ip|>
        ServerName              "|ServerName|"
        AuthUserFile            |AuthUserFile|

        SFTPEngine      On
        Port            22

        SFTPHostKey /etc/ssh/ssh_host_rsa_key
        SFTPHostKey /etc/ssh/ssh_host_dsa_key

</VirtualHost>

Again, the Port should match what you used in Step 4a

Step 5. Restart ProFTPD

Restart proftpd, Linux:

Code:

 service proftpd restart

FreeBSD:

Code:

 /usr/local/etc/rc.d/proftpd restart

Step 6. Test it out

Test it out! If you telnet to the new port you should see a greeting like this:

Code:

# telnet myserver.com 22
Trying 208.86.x.x...
Connected to myserver.com.
Escape character is '^]'.
SS´['Å0-mod_sftp/0.9.7
Lß    ç_ªC.ÃÇdiffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14- ...

That is normal. Now use an SFTP client like FileZilla and try it out. You should use the exact same usernames and passwords as you did previously for FTP.

Comments, questions?

**tillo** · 04-18-2009, 05:26 PM

I was about to correct you on writing the correct name for a FTP over SSL/TLS channel, which is FTPS and not SFTP, then I actualy read your post

and you are right, this is an SFTP (as in SecureSHell FTP) emulation performed by an FTP daemon. This is not FTPS (also known as S/FTP or Secure FTP), which is the mod_tls you were talking about.

I didn't know about mod_sftp, thank you for sharing this information.
I won't use it though, because SFTP is much more limited than FTP/FTPS: to list a few differences, files are delivered through the command channel, which limits one transfer or command at a time and also make FXP (remote to remote transfer) impossible; only binary transfers are possible AFAIK, no fast ASCII; SFTP with OpenSSH is very slow, even when used with blowfish chiper, don't know about ProFTPd/mod_sftp though -- is it fast enough?

It is true that FTPS doesn't crypt the transfer channel, and that the ip_conntrack_ftp netfilter module for linux can't track the transfer channel port and eventually open it if closed... I surely hope that the SFTP protocol will evolve in something better in the future, so I can use it. FTP is a very old and insecure protocol.

**rootbsd** · 04-20-2009, 07:07 AM

Originally Posted by tillo

files are delivered through the command channel, which limits one transfer or command at a time and also make FXP (remote to remote transfer) impossible;

True but on standard web hosting servers I don't think you will find people actually using FXP. Also you can transfer multiple files at a time, it just requires multiple logins. FileZilla client supports this - for example I just tested it with 8 simultaneous uploads.

Originally Posted by tillo

SFTP with OpenSSH is very slow, even when used with blowfish chiper, don't know about ProFTPd/mod_sftp though -- is it fast enough?

Well I guess it depends on what you consider "very slow". I'm able to saturate 100Mbit/s line using scp to copy to ProFTPD/mod_sftp (12.5MBytes/sec). On most shared web hosting servers, I don't think you will find users expecting to upload faster than 100Mbit/s.

Originally Posted by tillo

only binary transfers are possible AFAIK, no fast ASCII

I'm not sure what you mean, it seems to go plenty fast enough for me.

Originally Posted by tillo

I surely hope that the SFTP protocol will evolve in something better in the future, so I can use it. FTP is a very old and insecure protocol.

I kind of doubt SFTP will evolve much, I think it works great for most users.

**scsi** · 04-20-2009, 07:25 AM

mod_tls is better and easier.

**tillo** · 04-20-2009, 07:33 AM