Updated Dec 2, 2010
We all know plain FTP is insecure and its surprising how much it is still in use today.
DA comes with support for ProFTPD mod_tls however there are several problems with mod_tls. 1) It only encrypts the control channel of FTP, leaving the actual data transferred still in clear text. 2) That also causes problems with FTP traversal of firewalls since the firewall can't see which ports are going to be needed, although that can be worked around with PassivePorts configuration in ProFTPD. 3) FTP/TLS support is also less common in FTP clients.
I'm sure some here have been using SFTP with DirectAdmin however that is done over the system's SSH daemon. The problems with this are 1) users must be given ssh access to use SFTP. 2) You can't restrict SSH access to certain IPs if you have customers needing to use SFTP. 3) It only lets DirectAdmin Users login, if a user creates a child FTP account, it will not work for SFTP.
SFTP hasn't been supported by many common FTP servers such as ProFTPD, until TJ Saunders wrote a mod_sftp for ProFTPD. I've set it up for several people recently and it works really well. It addresses all of the above problems.
The only drawback to this implementation is that all users on the system will need to switch to SFTP. I might try to come up with a setup for running both SFTP and insecure-FTP later if there is demand.
Step 1. Change your ssh port (optional)
I recommend changing your ssh port if you haven't done so already. This is done by changing the Port line in /etc/ssh/sshd_config and restarting sshd. Make sure you know what you are doing before attempting this, since you could lock yourself out of the server.
Step 2. Compile new ProFTPD with mod_sftp instead of mod_tls
Assuming your system has custombuild already installed. If you don't have custombuild, go here to install it.
Step 3. Make sure new ProFTPD is working
Restart proftpd, Linux:
FreeBSD:
Make sure you can still connect to your FTP server. You should see version 1.3.3e:
Step 4a. Change Port in ProFTPD
Open /etc/proftpd.conf in an editor and change the Port to what you want SFTP to use. To make it easy on your users you could use Port 22 since it would be the default in SFTP clients. You could also pick something random such as 3822.
Step 4b. Enable SFTP in main proftpd.conf
Add the following lines to your /etc/proftpd.conf file, somewhere near the top of the file so its easy to find:
COMMENT OUT the 'bytes' log in /etc/proftpd.conf as well:
Step 4c. Enable SFTP in IP-based FTP vhosts
Add the following lines into EACH VirtualHost container in /etc/proftpd.vhosts.conf:
The Port should match what you used in Step 4a. Make sure you put these 4 new lines before EACH </VirtualHost> in that file.
ALSO COMMENT OUT the bytes log in each VirtualHost entry
Step 4d. Enable SFTP config in FTP vhost template
Open up /usr/local/directadmin/data/templates/custom/proftpd.vhosts.conf in an editor. This should be a new file that you don't currently have, paste in:
Again, the Port should match what you used in Step 4a
Step 5. Restart ProFTPD
Restart proftpd, Linux:
FreeBSD:
Step 6. Test it out
Test it out! If you telnet to the new port you should see a greeting like this:
That is normal. Now use an SFTP client like FileZilla and try it out. You should use the exact same usernames and passwords as you did previously for FTP.
Comments, questions?
We all know plain FTP is insecure and its surprising how much it is still in use today.
DA comes with support for ProFTPD mod_tls however there are several problems with mod_tls. 1) It only encrypts the control channel of FTP, leaving the actual data transferred still in clear text. 2) That also causes problems with FTP traversal of firewalls since the firewall can't see which ports are going to be needed, although that can be worked around with PassivePorts configuration in ProFTPD. 3) FTP/TLS support is also less common in FTP clients.
I'm sure some here have been using SFTP with DirectAdmin however that is done over the system's SSH daemon. The problems with this are 1) users must be given ssh access to use SFTP. 2) You can't restrict SSH access to certain IPs if you have customers needing to use SFTP. 3) It only lets DirectAdmin Users login, if a user creates a child FTP account, it will not work for SFTP.
SFTP hasn't been supported by many common FTP servers such as ProFTPD, until TJ Saunders wrote a mod_sftp for ProFTPD. I've set it up for several people recently and it works really well. It addresses all of the above problems.
The only drawback to this implementation is that all users on the system will need to switch to SFTP. I might try to come up with a setup for running both SFTP and insecure-FTP later if there is demand.
Step 1. Change your ssh port (optional)
I recommend changing your ssh port if you haven't done so already. This is done by changing the Port line in /etc/ssh/sshd_config and restarting sshd. Make sure you know what you are doing before attempting this, since you could lock yourself out of the server.
Step 2. Compile new ProFTPD with mod_sftp instead of mod_tls
Assuming your system has custombuild already installed. If you don't have custombuild, go here to install it.
Code:
cd /usr/local/directadmin/custombuild
./build update
perl -pi -e 's/proftpd=no/proftpd=yes/g' options.conf
mkdir -p custom/proftpd
cp configure/proftpd/configure.proftpd custom/proftpd/configure.proftpd
perl -pi -e 's/mod_tls/mod_sftp/g' custom/proftpd/configure.proftpd
./build proftpdStep 3. Make sure new ProFTPD is working
Restart proftpd, Linux:
Code:
service proftpd restart
Code:
/usr/local/etc/rc.d/proftpd restartMake sure you can still connect to your FTP server. You should see version 1.3.3e:
Code:
# ftp myserver.com
Connected to myserver.com (208.86.x.x).
220 ProFTPD 1.3.3e Server ready.
Name (myserver.com):Step 4a. Change Port in ProFTPD
Open /etc/proftpd.conf in an editor and change the Port to what you want SFTP to use. To make it easy on your users you could use Port 22 since it would be the default in SFTP clients. You could also pick something random such as 3822.
Code:
Port 22Step 4b. Enable SFTP in main proftpd.conf
Add the following lines to your /etc/proftpd.conf file, somewhere near the top of the file so its easy to find:
Code:
##
## SFTP Config
SFTPEngine On
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_dsa_key
SFTPClientMatch "WS_FTP" channelWindowSize 1GB
# enable for sftp debugging:
#TraceLog /var/log/proftpd/sftp-trace.log
#Trace scp:20 sftp:20 ssh2:20
## End SFTP Config
##COMMENT OUT the 'bytes' log in /etc/proftpd.conf as well:
Code:
#ExtendedLog /var/log/proftpd/1.2.3.4.bytes WRITE,READ userlogStep 4c. Enable SFTP in IP-based FTP vhosts
Add the following lines into EACH VirtualHost container in /etc/proftpd.vhosts.conf:
Code:
SFTPEngine On
Port 22
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_dsa_keyThe Port should match what you used in Step 4a. Make sure you put these 4 new lines before EACH </VirtualHost> in that file.
ALSO COMMENT OUT the bytes log in each VirtualHost entry
Step 4d. Enable SFTP config in FTP vhost template
Open up /usr/local/directadmin/data/templates/custom/proftpd.vhosts.conf in an editor. This should be a new file that you don't currently have, paste in:
Code:
<VirtualHost |ip|>
ServerName "|ServerName|"
AuthUserFile |AuthUserFile|
SFTPEngine On
Port 22
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_dsa_key
</VirtualHost>Again, the Port should match what you used in Step 4a
Step 5. Restart ProFTPD
Restart proftpd, Linux:
Code:
service proftpd restart
Code:
/usr/local/etc/rc.d/proftpd restartStep 6. Test it out
Test it out! If you telnet to the new port you should see a greeting like this:
Code:
# telnet myserver.com 22
Trying 208.86.x.x...
Connected to myserver.com.
Escape character is '^]'.
SS´['Å0-mod_sftp/0.9.7
Lß ç_ªC.ÃÇdiffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14- ...That is normal. Now use an SFTP client like FileZilla and try it out. You should use the exact same usernames and passwords as you did previously for FTP.
Comments, questions?
Last edited:
and you are right, this is an SFTP (as in SecureSHell FTP) emulation performed by an FTP daemon. This is not FTPS (also known as S/FTP or Secure FTP), which is the mod_tls you were talking about.
