Need help getting SFTP working - UPDATE

I

IT_Architect

Verified User
Joined
Feb 27, 2006
Messages
1,088
- I moved SSH to port 44 and opened it in the firewall
- I followed the instructions here: How to install mod_sftp into ProFTPD and changed the port to 22
- In the firewall plugin I can see ssh on 44 on sshd and proftpd on 21 and 22.

Using FileZilla:
- I can log in ftp - and the localhost telnet test works fine
- I can log in ftps explicit - and the localhost telnet test works fine
- I cannot log sftp SFTP - and the localhost telnet test does NOT work and returns this:
Trying ::1...
Connected to localhost.
Escape character is '^]'.
Connection closed by foreign host.
- I turned the firewall off and it made no difference.

Update:
- With ftps working, we know ProFTPd has no problem finding keys and authenticating users for ftps on port 21.
- /var/log/proftpd/sftp.log shows:
2021-11-06 17:12:31,257 mod_sftp/1.0.1[55154]: no available host keys, unable to handle session
- The fact that it posted the error from a connection attempt on port 22 proves that ProFTPd is reading the /etc/proftpd.sftp.conf where port 22 is specified rather than the original port 23.
- /etc/proftpd.sftp.conf shows:
SFTPHostKey /etc/ssh/ssh_host_rsa_key (/etc/ssh/ssh_host_rsa_key exists in that location)
SFTPAuthorizedUserKeys file:~/.sftp/authorized_keys (no authorized_keys file exists anywhere on disk)

Error Message from FileZilla
Status: Connecting to xxx.xxx.xxx.xx
Response: fzSftp started, protocol_version=11
Command: open "[email protected]@xxx.xxx.xxx.xx" 22
Error: Could not connect to server

Error Message from WinSCP
The server rejected SFTP connection, but it listens for FTP connections.
Did you want to use FTP protocol instead of SFTP? Prefer using encryption.

What am I missing?
 
Last edited:
SFTP is working fine here but I'm using pureftpd. Hopefully someone can help you on this.
 
MaXi32 said:
SFTP is working fine here but I'm using pureftpd. Hopefully someone can help you on this.
Click to expand...
By working fine, do you mean also using virtual ftp users or do you mean by giving away the user's account credentials? Port 21 has no secure options since ftps went Explicit.

Update: I determined this morning what is wrong with DA's install program and will post back when I get back.
 
Last edited:
I remember sftp centos8 pureftp working longer time ago , something in config with encryption cyphers and then also problem with updates then have to change again key's or encryption parts. port 23 ...

Now i don't need and for users there also filemanager DA... and cms aplications themself

So i am not having op to date info in my own memory, disabled ftp and use stpd ssh on other port in winscp


This secure cookies and https sessions only in: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

Built-in Session Management Implementations​


Web development frameworks, such as J2EE, ASP .NET, PHP, and others, provide their own session management features and associated implementation. It is recommended to use these built-in frameworks versus building a home made one from scratch, as they are used worldwide on multiple web environments and have been tested by the web application security and development communities over time.


However, be advised that these frameworks have also presented vulnerabilities and weaknesses in the past, so it is always recommended to use the latest version available, that potentially fixes all the well-known vulnerabilities, as well as review and change the default configuration to enhance its security by following the recommendations described along this document.


The storage capabilities or repository used by the session management mechanism to temporarily save the session IDs must be secure, protecting the session IDs against local or remote accidental disclosure or unauthorized access.
Click to expand...
 
Last edited:
ikkeben said:
I remember sftp centos8 pureftp working longer time ago , something in config with encryption cyphers and then also problem with updates then have to change again key's or encryption parts. port 23 ...

Now i don't need and for users there also filemanager DA... and cms aplications themself

So i am not having op to date info in my own memory, disabled ftp and use stpd ssh on other port in winscp
Click to expand...
As mentioned, I have it solved. I'm just working on the best procedures.
 
You must log in or register to reply here.
Back
Top