Is it possible to use SFTP with Virtualmin??

eclipse · March 20, 2015, 9:43am

Hi Fakemoth

I took a new look at the setup today and I managed to get it working
What I found out was that the module mod_sftp.c was not loaded.
That’s the reason the server was not listening on port 2222


# Support for the SSH2, SFTP, and SCP protocols, for secure file transfer over
# an SSH2 connection (http://www.castaglia.org/proftpd/modules/mod_sftp.html)
   LoadModule mod_sftp.c

After I removed the # from the line above and restarted the services sshd, proftpd I was able to logon with a normal FTP user using SFTP on port 2222.

Success all over

Below is what I had to do.
Uncomment the line below in /etc/proftpd.conf

Support for the SSH2, SFTP, and SCP protocols, for secure file transfer over

an SSH2 connection (http://www.castaglia.org/proftpd/modules/mod_sftp.html)

LoadModule mod_sftp.c

Attach the below code in /etc/proftpd.conf
SFTPEngine on Port 2222 SFTPLog /var/log/proftpd/sftp.log

    # Configure both the RSA and DSA host keys, using the same host key
    # files that OpenSSH uses.
    SFTPHostKey /etc/ssh/ssh_host_rsa_key
    SFTPHostKey /etc/ssh/ssh_host_dsa_key

    #SFTPAuthMethods publickey

    SFTPAuthMethods password
    #SFTPAuthorizedUserKeys file:/etc/proftpd/authorized_keys/%u

    # Enable compression
    SFTPCompression delayed

Commented the line below for SSH in the file /etc/ssh/sshd_config

Subsystem sftp /usr/lib/openssh/sftp-server

Restart the 2 services sshd and proftpd
service sshd restart service proftpd restart

Then it works

Unbelievable that I didn’t see the module in the proftpd.conf file before.

Tim

eclipse · March 20, 2015, 9:53am

Hi again

Will the normal FTP on port 21 not work while using the SFTP option above?

Tim

fakemoth · March 20, 2015, 10:53am

Glad you did it! Didn’t think about that setting - was suspecting network issues. But I dropped the FTP for good, closed ports, etc as this was the point, right?

eclipse · March 20, 2015, 12:14pm

Hi all

I managed to get both FTP and SFTP working at the same time.
I just added the < virtualhost a.b.c.d > tag in the < ifmodule > configuration.
Where a.b.c.d represent the IP of the server.



   
        SFTPEngine on
        Port 2222
        SFTPLog /var/log/proftpd/sftp.log
    # Configure both the RSA and DSA host keys, using the same host key
    # files that OpenSSH uses.
    SFTPHostKey /etc/ssh/ssh_host_rsa_key
    SFTPHostKey /etc/ssh/ssh_host_dsa_key

    #SFTPAuthMethods publickey

    SFTPAuthMethods password
    #SFTPAuthorizedUserKeys file:/etc/proftpd/authorized_keys/%u

    # Enable compression
    SFTPCompression delayed

Tim

Joe · April 24, 2015, 3:15am

Not that I want to revive this chaotic thread (or the really grumpy one that it links to), but I just wanted to chime in that I’ve committed changes to virtualmin-base on both CentOS/RHEL and Debian/Ubuntu to enable this by default.

It will not go into current operating system installs for at least another few days (and older systems will never get it, as there have been too many changes in virtualmin-base for me to be comfortable rolling it out without some testing), but Debian 8 (coming in a few days) will have SFTP enabled on port 2222 immediately after installation.

This will not effect already installed systems, so if you’re already running Virtualmin and want this feature enabled in ProFTPd, add the following to the end of proftpd.conf (or sftpd.conf in /etc/proftpd/conf.d if you have such a directory):


LoadModule mod_sftp.c

    SFTPEngine on
    Port 2222
    SFTPLog /var/log/proftpd/sftp.log

    # Configure both the RSA and DSA host keys, using the same host key
    # files that OpenSSH uses.
    SFTPHostKey /etc/ssh/ssh_host_rsa_key
    SFTPHostKey /etc/ssh/ssh_host_dsa_key

    SFTPAuthorizedUserKeys file:~/.sftp/authorized_keys

    # Enable compression
    SFTPCompression delayed

And restart the proftpd server. Note that this is somewhat simplified from some of the other examples that have been posted and linked, and less prone to user error or confusion (some of the examples only allow key-based authentication, which is beyond many users comfort zone).

fakemoth · April 27, 2015, 7:32am

This is good news indeed, thanks Joe; will gladly remove any link offensive, it seems I blew some steam here against exactly 2 users in the last weeks that were escalating discussions with personal accusations. This is not the place, agreed.

What link are you referring to, the 2012 post with the graphical console?

Rhandy · December 7, 2016, 11:53am

LoadModule mod_sftp.c

    SFTPEngine on
    Port 2222
    SFTPLog /var/log/proftpd/sftp.log

    # Configure both the RSA and DSA host keys, using the same host key
    # files that OpenSSH uses.
    SFTPHostKey /etc/ssh/ssh_host_rsa_key
    SFTPHostKey /etc/ssh/ssh_host_dsa_key

    SFTPAuthorizedUserKeys file:~/.sftp/authorized_keys

    # Enable compression
    SFTPCompression delayed

Ok I can use this, but I have to create keys for users by hand.

Any way for Virtualmin auto create keys for users?

Rhandy · December 7, 2016, 9:34pm

I try to create one script to put on server creation:
Virtualmin -> System Settings -> Virtualmin Configuration ->Actions upon server and user creation -> Command to run before making changes to a server:

BUT I CAN´T GET USER PASSWORD ON CREATION -> #VIRTUALSERVER_PASS is always empty

#!/bin/ksh

####### CREATE SSH KEYS FOR PROFTD - SFTP USE ###################

if [ ! “$VIRTUALSERVER_PARENT” ]
then
if [ “$VIRTUALSERVER_ACTION” == “CREATE_DOMAIN” ]
then
if [ ! “$VIRTUALSERVER_CREATED” ]
then

      mkdir -p /$VIRTUALSERVER_HOME/.ssh
      ssh-keygen -t rsa -b 4096 -N $VIRTUALSERVER_PASS -f /$VIRTUALSERVER_HOME/.ssh/mysshkey
     sudo ssh-keygen -e /$HOME/.ssh/mysshkey.pub | sudo tee /etc/proftpd/authorized_keys/$VIRTUALSERVER_DOM
    echo " VIRTUAL SERVER DOM = "$VIRTUALSERVER_DOM
    echo " VIRTUAL SERVER USER =" $VIRTUALSERVER_USER
    echo "VIRTUAL SERVER HOME =" $VIRTUALSERVER_HOME
    echo "VIRTUAL SERVER PASS ="$VIRTUALSERVER_PASS ### >>>>>> empty
    echo "Setting up $VIRTUALSERVER_DOM to  environment for sftp"
    echo " .. done"
fi

fi
fi

Rhandy · December 8, 2016, 12:23am

Ok

Is done!!

I create one CUSTOM FIELD = PASSSSH

and script

#!/bin/sh

if [ “$VIRTUALSERVER_PARENT” = “” ]; then
if [ “$VIRTUALSERVER_ACTION” = “CREATE_DOMAIN” ]; then
cd $VIRTUALSERVER_HOME
mkdir .ssh
chown $VIRTUALSERVER_USER:$VIRTUALSERVER_GROUP .ssh
chmod 700 .ssh
sudo ssh-keygen -t rsa -b 4096 -N $VIRTUALSERVER_FIELD_PASSSSH -f $VIRTUALSERVER_HOME/.ssh/mysshkey
sudo ssh-keygen -e -f $VIRTUALSERVER_HOME/.ssh/mysshkey.pub | sudo tee /etc/proftpd/authorized_keys/$VIRTUALSERVER_USER
echo " PASWORD SSH =" $VIRTUALSERVER_FIELD_PASSSSH
echo " Setting up $VIRTUALSERVER_DOM to environment for sftp"
echo " … done"
fi

if [ “$VIRTUALSERVER_ACTION” = “MODIFY_DOMAIN” ]; then

for verify is field is not empty

if [ "$VIRTUALSERVER_FIELD_PASSSSH" != "" ]; then

######## create new key with new password
sudo rm -Rf $VIRTUALSERVER_HOME/.ssh
cd $VIRTUALSERVER_HOME
mkdir .ssh
chown $VIRTUALSERVER_USER:$VIRTUALSERVER_GROUP .ssh
chmod 700 .ssh
sudo ssh-keygen -t rsa -b 4096 -N $VIRTUALSERVER_FIELD_PASSSSH -f $VIRTUALSERVER_HOME/.ssh/mysshkey
sudo ssh-keygen -e -f $VIRTUALSERVER_HOME/.ssh/mysshkey.pub | sudo tee /etc/proftpd/authorized_keys/$VIRTUALSERVER_USER
echo " PASWORD SSH =" $VIRTUALSERVER_FIELD_PASSSSH
echo " Setting New SFTP password for domain $VIRTUALSERVER_DOM to environment for sftp"
echo " … done"
fi
fi
fi