Difference between revisions of "SCP and SFTP"
(remove language suffix from Category:Secure Shell (English), see Talk:Table of Contents#English Category Names: Capitalization and Conflict with i18n)
m (Remove from Daemon category. See Talk:Table of Contents#Remove Category:Daemons and system services.)
|Line 1:||Line 1:|
== Introduction ==
== Introduction ==
Revision as of 08:08, 16 December 2012
SFTP refers to various forms of (more or less) secure file transfer protocols. This article lists two examples and how to set them up.
SSH file transfer protocol
SSH file transfer protocol is a FTP-like protocol that allows secure file transfer and manipulation, encrypting both passwords and transferred data.
Setting up SSH file transfer protocol with OpenSSH
To set up SFTP you only need to install and configure OpenSSH. Once you have this running, SFTP is running too because the default configuration file enables it. Follow the instructions below for older configs.
/etc/ssh/sshd_config with your favorite editor and add this line:
Subsystem sftp /usr/lib/ssh/sftp-server
2. Restart the SSH-daemon with:
# rc.d restart sshd
And it should work. You can access your files with the sftp program or sshfs. Many standard FTP programs should work as well.
FTP over SSH
FTP over SSH encrypts passwords unlike plain FTP. FTP over SSH is not really a true protocol, it is just SSH + FTP or TLS/SSL + FTP . Note that there are many ways to set this up. This is one of them.
This setup in particular (usingAUR + TLS) encrypts usernames, passwords, commands and server replies, but does NOT encrypt the data channel. This also means that there is reduced performance cost on data transfer.
Setting up FTP with pure-ftpd
Install this wiki article.AUR as directed in
Then you can go ahead and edit the configuration file:
# vi /etc/pure-ftpd.conf
You can start and stop the
pure-ftpd daemon by
# rc.d start pure-ftpd # rc.d stop pure-ftpd # rc.d restart pure-ftpd
and you can set it to automatically start by adding it to the daemons list in
Set up Certificates
Refer to the documentation for more information. The short version is this:
1. Create a Self-Signed Certificate:
# mkdir -p /etc/ssl/private # openssl req -x509 -nodes -newkey rsa:1024 -keyout \ /etc/ssl/private/pure-ftpd.pem \ -out /etc/ssl/private/pure-ftpd.pem
2. Make it private:
# chmod 600 /etc/ssl/private/*.pem
3. Be aware that using 1024 bits in some countries is against the law. Choose 512 or less if unsure.
Towards the bottom of
/etc/pure-ftpd.conf you should find a section for TLS. Uncomment and change the TLS setting to 1 (which enables both FTP and SFTP):
Now restart the pure-ftpd daemon and you should be able to log in with SFTP-enabled clients (e.g. FileZilla, SmartFTP). (Do not forget to use port 22.)