5 ms·

I'd second this, I've longed struggled to come up with a easy-to-deploy sshd/sftp/chroot configuration that permitted easy database-driven configuration w/o ext

I'd second this, I've longed struggled to come up with a easy-to-deploy sshd/sftp/chroot configuration that permitted easy database-driven configuration w/o extra shell access. You have to fight a lot of defaults to get this just right. Would the OpenSSH upstream accept patches for an unprivileged sshd/sftp-subsystem to make this easier to use their battle tested code?

Nux 7y ago
Proftpd can do sftp-only out of the box.
- jasonjayr 7y ago
  I am not sure why I didn't realize that sooner, but that's awesome, thank you for pointing that out.
- pilif 7y ago
  on the other hand, its SQL backend modules insist on fetching a password and comparing them using their own functionality and there's no way to get to the the user's typed password into a custom query. That means that there's no way to authenticate users if you use a password encryption scheme not supported by the bundled modules (like bcrypt for example)
sandreas 7y ago
If you just want to share files and not giving the option to upload files, you could try graft... https://github.com/sandreas/graft https://github.com/sandreas/graft graft serve ./*.txt will serve every txt file in the current dir...
- yjftsjthsd-h 7y ago
  For that use case, I just use `python3 -m http.server` (or the Python 2 equivalent), especially since Python is almost always already installed.
  - sandreas 7y ago
    Cool... is SSL support for secure file transfer?
- concert-gilled 7y ago
  If you don't mind, I have a question about graft. > graft will prompt for a password, run an sftp server and promote it via zeroconf. Is that a one time password that will be used by the "receiver" to download the file?
  - sandreas 7y ago
    No, it is a static unchangeable password. Graft can't "manage" user accounts, it just has one user with password. It does not support keyfiles or other authentication mechanisms. I wrote graft to have a simple portable tool for transfering files in a network without shares - the main idea behind it was to run: graft serve myfiles/*.txt on the server side and then graft receive on the client side without having to remember the ip or hostname - because zeroconf / mdns is used, it will find the server automatically, if the network is not too big. If there is more than one server, it will prompt you to choose the right one. I only used SFTP, because it is a secure way to transfer files over the network.

Nux 7y ago

Proftpd can do sftp-only out of the box.

jasonjayr 7y ago
I am not sure why I didn't realize that sooner, but that's awesome, thank you for pointing that out.
pilif 7y ago
on the other hand, its SQL backend modules insist on fetching a password and comparing them using their own functionality and there's no way to get to the the user's typed password into a custom query. That means that there's no way to authenticate users if you use a password encryption scheme not supported by the bundled modules (like bcrypt for example)

sandreas 7y ago

If you just want to share files and not giving the option to upload files, you could try graft... https://github.com/sandreas/graft https://github.com/sandreas/graft graft serve ./*.txt will serve every txt file in the current dir...

yjftsjthsd-h 7y ago
For that use case, I just use `python3 -m http.server` (or the Python 2 equivalent), especially since Python is almost always already installed.
- sandreas 7y ago
  Cool... is SSL support for secure file transfer?
concert-gilled 7y ago
If you don't mind, I have a question about graft. > graft will prompt for a password, run an sftp server and promote it via zeroconf. Is that a one time password that will be used by the "receiver" to download the file?
- sandreas 7y ago
  No, it is a static unchangeable password. Graft can't "manage" user accounts, it just has one user with password. It does not support keyfiles or other authentication mechanisms. I wrote graft to have a simple portable tool for transfering files in a network without shares - the main idea behind it was to run: graft serve myfiles/*.txt on the server side and then graft receive on the client side without having to remember the ip or hostname - because zeroconf / mdns is used, it will find the server automatically, if the network is not too big. If there is more than one server, it will prompt you to choose the right one. I only used SFTP, because it is a secure way to transfer files over the network.