Add secure option for FTP (FTPS/SFTP)

[Neustradamus]

Can you add security possibilites for unsecured FTP?

• FTPS
• SFTP

File Transfer Protocol | Derivatives

[mrmarkuz (Markus Neuberger)]

There are custom templates instructions already - just for info:

SFTP login / template-custom ssh

It seems to be possible, there’s a db property to disable the sftp subsystem. config setprop sshd SubsystemSftp no Create a custom template: mkdir -p /etc/e-smith/templates-custom/etc/ssh/sshd_config/ Create /etc/e-smith/templates-custom/etc/ssh/sshd_config/80Custom with following content: # Custom settings SyslogFacility AUTHPRIV GSSAPIAuthentication yes GSSAPICleanupCredentials yes AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_…

Secure ftp while connecting with Filezilla

The config from Nethserver doesnt support ftpes out of the box. It can be added with a little bit of extra config: mkdir -p /etc/e-smith/templates-custom/etc/vsftpd/vsftpd.conf touch /etc/e-smith/templates-custom/etc/vsftpd/vsftpd.conf/90ssl edit the just created /etc/e-smith/templates-custom/etc/vsftpd/vsftpd.conf/90ssl and add: rsa_cert_file=/etc/pki/tls/certs/localhost.crt rsa_private_key_file=/etc/pki/tls/private/localhost.key ssl_enable=YES allow_anon_ssl=NO force_local_data_s…

[Neustradamus]

@mrmarkuz Thanks but I request directly in Nethtgui/Cockpit with personal modifications for all people

[Neustradamus]

It is to improve security of the old unsecured 21 port.

[davidep (Davide Principi)]

At the times of virtual hosts implementation in ns7 we were thinking about FTPS, but then decided to not implement it because of the availability of a valid and simple alternative: SFTP. Furthermore, as FTP is clear-text, FTP-only accounts are used.

Enable ftp by default

NethServer 7 needs ftp for write access to virtual hosts. ftp access is disabled by default. I’d like to have it enabled by default, and I’d like to discuss pro and cons. AFAIK, ftp password is transmitted in clear text, but, if stolen, it’d give access only to the virtual host. How do webmasters work these days?

[Neustradamus]

Host companies have added the support of secure connections.

[danb35 (Dan)]

…and Neth already has this as well, via SFTP. This is already there.

[pike (Michael Kicks)]

… i looked for SFTP into documentationd and i were… clueless.
There’s FTP…
https://docs.nethserver.org/en/v7/ftp.html

But i did not found SFTP.

[EddieA (Eddie Atherton)]

sftp is there by default and there’s nothing to configure. It’s part of ssh, so uses the “regular” users defined to the system.

Cheers.

[Neustradamus]

I have created an account here:

• https://IP:980/en-US/FTP
• https://IP:9090/nethserver#/applications/nethserver-httpd

Badly, the user can not connect in SFTP.

[EddieA (Eddie Atherton)]

The users created on those pages only have ftp access, for security reasons.

Because sftp is part of ssh, it uses the system users.

Cheers.

[Neustradamus]

So it is not good.

For security, the goal of the ticket is to add right to users to connect with secure FTP

[NLS (Nick Sardelianos)]

Actually everything should be a matter of user right or participation in specific groups.
Like what is done with secure systems for decades (including Linux that Nethserver is built over).

[Neustradamus]

Of course, I do not speak about root account of the server.
I speak about users from Netgui/Cockpit (LDAP/AD).

[davidep (Davide Principi)]

Ok, but why not using sftp which is already implemented and available?

Why is FTPS important? What is it good for and what are we missing with similar file sharing solutions like SFTP, Nextcloud, Samba.

[danb35 (Dan)]

@Neustradamus

For security, the goal of the ticket is to add right to users to connect with secure FTP

Which, once again, they already have. What isn’t there (and I don’t see any particular reason it should be) is dedicated users whose only ability is to log in that way.

[Neustradamus]

When we create an user in FTP part (Nethgui/Cockpit), the SFTP or FTPS do not work.
There is no option to enable/disable:

• FTP
• SFTP
• FTPS

[danb35 (Dan)]

@Neustradamus

When we create an user in FTP part (Nethgui/Cockpit), the SFTP or FTPS do not work.

Correct. Why do they need to? System users (the ones who can log in via SSH) are able to use SFTP. What use do you see for other users who can only do SFTP?

[Neustradamus]

About SFTP, I do not speak about system users, I speak about users/groups from LDAP/AD.

System users /= Users/Groups from LDAP/AD

[danb35 (Dan)]

@Neustradamus

About SFTP, I do not speak about system users, I speak about users/groups from LDAP/AD.

OK, for “system users”, read “users created through the GUI.” That’s what I get for truncating my thoughts. Those users (which are in some form of LDAP storage, either OpenLDAP or AD) have the ability to log in via SSH, and therefore also the ability to use SFTP. You’re asking for the ability to create separate users to do SFTP. Why?