I started writing a post asking about SSH public key authentication to SFTP files to virtual hosts on NS8, but then I found that you can configure public keys per-user in the SFTPGo web admin pages. Well and good.
But as I look over the options for scp, I’m thinking it can’t quite do what I’m wanting to do and I’d need rsync instead. So let me back up a bit.
I’m (slowly) moving services from my NS7 server to my NS8 server, and two of those services are my own repo of NS7 modules, and my mirror of @stephdl’s repo. Moving the data from the old system to the new is simple enough with scp -r, but keeping it up to date is the problem, especially for my own repo. So I’m thinking the way to go is to update the data on a separate system, and periodically push it out to the NS8 system. Particularly with my own repo, this moves private key material off of the public system, which is a definite security win.
But I still need to push the data out to the NS8 system. scp -r -P 3092 * 9005@ns8:/ will do it, but will copy everything every time–seems wasteful. rsync seems like the way around this, but I’m not sure it can be made to work this way–any input?
rsync is traditionally “push”. makes it difficult to get all right, especially permissions.
But with what you know now about containers (Sorry, I had an unexpected vsitor then, but MrMarkuz was able to help you then!), you can also think about “pull”…
A cron job inside the container triggers the defined rsync pull, eliminating all permission issues.
→ your rsync job runs from the container, with the right permissions from the start.
Cron is installed in the sftpgo container but needs to be started.
If pull is not an option, it’s possible to use rsync to connect after enabling rsync as ssh command.
Enter environment:
runagent -m webserver1
To be able to write to the root directory of the sftpgo user 9003, owner and permissions need to be set:
Edit the sftpgo service using systemctl to override the config so it survives updates:
systemctl --user edit sftpgo
and add following content between the already existing comments:
We’re overriding the ExecStart in the Service section.
### Editing /home/webserver1/.config/systemd/user/sftpgo.service.d/override.conf
### Anything between here and the comment below will become the new contents of the file
[Service]
ExecStart=
ExecStart=/usr/bin/podman run --conmon-pidfile %t/sftpgo.pid \
--cidfile %t/sftpgo.ctr-id --cgroups=no-conmon \
--pod-id-file %t/webserver.pod-id --replace -d --name sftpgo \
--volume websites:/srv/sftpgo/data:z \
--volume sftpgo_backups:/srv/sftpgo/backups:Z \
--volume sftpgo_config:/var/lib/sftpgo:Z \
--volume %S/state/sftpgo.conf.d/admin.json:/etc/sftpgo/admin.json:Z \
--env SFTPGO_LOADDATA_FROM=/etc/sftpgo/admin.json \
--env SFTPGO_HTTPD__WEB_ROOT=${TRAEFIK_PATH}\
--env SFTPGO_SFTPD__ENABLED_SSH_COMMANDS=rsync \
--user 0:0 \
${SFTPGO_IMAGE}
### Lines below this comment will be discarded
Restart sftpgo:
systemctl --user restart sftpgo
Now it should be possible to use rsync to connect to sftpgo like
Maybe we should implement this to the ns8-webserver app and enable cron by default? BTW, I found that cron is missing in ns8-lamp. @stephdl should I open PRs?
We should think for webserver on what to do. If cron is already added to sftpgo it should be easy for us but i do not like to modify the permission…is it a mandatory ?
I found no other way to upload a file to the root directory without changing owner and permissions of the sftpgo user dir (eg 9001)
IIRC it’s also the same issue when web installers want to create files in that directory.
EDIT:
But it’s just needed to create the file. If it already exists, it works with the default owner/perms.
