DA comes with support for ProFTPD mod_tls however there are several problems with mod_tls. 1) It only encrypts the control channel of FTP, leaving the actual data transferred still in clear text. 2) That also causes problems with FTP traversal of firewalls since the firewall can’t see which ports are going to be needed, although that can be worked around with PassivePorts configuration in ProFTPD. 3) FTP/TLS support is also less common in FTP clients.

I’m sure some here have been using SFTP with DirectAdmin however that is done over the system’s SSH daemon. The problems with this are 1) users must be given ssh access to use SFTP. 2) You can’t restrict SSH access to certain IPs if you have customers needing to use SFTP. 3) It only lets DirectAdmin Users login, if a user creates a child FTP account, it will not work for SFTP.

SFTP hasn’t been supported by many common FTP servers such as ProFTPD, until TJ Saunders recently wrote a mod_sftp for ProFTPD. I’ve set it up for several people recently and it works really well. It addresses all of the above problems.

The only drawback to this implementation is that all users on the system will need to switch to SFTP. I might try to come up with a setup for running both SFTP and insecure-FTP later if there is demand.

Step 1. Change your ssh port (optional)

I recommend changing your ssh port if you haven’t done so already. This is done by changing the Port line in /etc/ssh/sshd_config and restarting sshd. Make sure you know what you are doing before attempting this, since you could lock yourself out of the server.

Step 2. Compile new ProFTPD with mod_sftp

Assuming your system has all of the tools and libraries for compiling, just run these commands:

Code:

cd /usr/src
wget http://files.directadmin.com/services/customapache/proftpd-1.3.2.tar.gz
tar xvzf proftpd-1.3.2.tar.gz
cd proftpd-1.3.2
cd contrib
wget http://www.castaglia.org/proftpd/modules/proftpd-mod-sftp-0.9.6.tar.gz
tar xvfz proftpd-mod-sftp-0.9.6.tar.gz
cd ..
install_user=ftp install_group=ftp ./configure \
–prefix=/usr/local –sysconfdir=/etc \
–localstatedir=/var/run –mandir=/usr/local/man \
–without-pam –disable-auth-pam –enable-openssl \
–with-modules=mod_ratio:mod_readme:mod_sftp LDFLAGS=-static

Note: change prefix to /usr if this is Linux instead of FreeBSD.

Code:

make
make install

Step 3. Make sure new ProFTPD is working

Restart proftpd, Linux:

Code:

service proftpd restart

FreeBSD:

Code:

/usr/local/etc/rc.d/proftpd restart

Make sure you can still connect to your FTP server. You should see version 1.3.2:

Code:

# ftp myserver.com
Connected to myserver.com (210.245.x.x).
220 ProFTPD 1.3.2 Server ready.
Name (myserver.com):

Step 4a. Change Port in ProFTPD

Open /etc/proftpd.conf in an editor and change the Port to what you want SFTP to use. To make it easy on your users you could use Port 22 since it would be the default in SFTP clients. You could also pick something random such as 3822.

Code:

Port 22

Step 4b. Enable SFTP in main proftpd.conf

Add the following lines to your /etc/proftpd.conf file, somewhere near the top of the file so its easy to find:

Code:

SFTPEngine On
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_dsa_key

Step 4c. Enable SFTP in IP-based FTP vhosts

Add the following lines into EACH VirtualHost container in /etc/proftpd.vhosts.conf:

Code:

SFTPEngine On
Port 22
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_dsa_key

The Port should match what you used in Step 4a. Make sure you put these 4 new lines before EACH </VirtualHost> in that file.

Step 4d. Enable SFTP config in FTP vhost template

Add the same 4 lines into /usr/local/directadmin/data/templates/proftpd.vhosts.conf before the </VirtualHost> line

Code:

SFTPEngine On
Port 22
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_dsa_key

Again, the Port should match what you used in Step 4a

Step 5. Restart ProFTPD

Restart proftpd, Linux:

Code:

service proftpd restart

FreeBSD:

Code:

/usr/local/etc/rc.d/proftpd restart

Step 6. Test it out

Test it out! If you telnet to the new port you should see a greeting like this:

Code:

# telnet myserver.com 22
Trying 210.245.x.x…
Connected to myserver.com.
Escape character is ‘^]’.
SS´[‘Å0-mod_sftp/0.9.6
Lß ç_ªC.ÃÇdiffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14- …

That is normal. Now use an SFTP client like FileZilla and try it out. You should use the exact same usernames and passwords as you did previously for FTP.}

Incoming search terms: