Cloud FTP, FTPS, SFTP Configuration

This page provides configuration information for Cloud FTP, a server protocol for Access Anywhere supporting FTP, FTPS and SFTP. For user documentation see Cloud FTP .

Setting the domain name during installation allows FTP and FTPS to be be accessed through the domain name.

The services will be available at the following ports:

All firewall settings are already configured for the default basic configuration.

To access the ftp server via a custom domain name instead of the one configured for the appliance create an A or CNAME DNS record pointing to the IP address or domain name of the appliance. Any fully-qualified domain name can be used.

FTP w/TLS and FTPS clients are not as strict as web browsers when using self signed certificates. Regardless, if a client needs to use a properly signed certificate the process is as follows:

1. Upload certificate public and private key to Access Anywhere, preferably in the following directories

   a. Private key in /etc/pki/tls/private/
   b. Ordered List ItemPublic key in =/etc/pki/tls/certs/

2. Update ftpserver.conf entries
   a. pathToSSLkey should point to the private key
   b. pathToSSLcert should point to the public certificate
   
3. Restart CloudFTP service

FTP Passive Mode requires that the FTP server sends the client the port and IP address of Access Anywhere. When Access Anywhere is secured behind a public firewall the internal IP address will most likely not match the public IP address. Set up passive mode as follows:

1. Add the following entry to ftpserver.conf

   a. external_ip_for_passive_mode=xxx.xxx.xxx.xxx

2. Restart CloudFTP service

Each of the CloudFTP file transfer services requires configuration. For many customers the configuration created when CloudFTP is started the first time will be sufficient and no additional (manual) configuration will be required.

Automatic configuration with little or no need for additional (manual) configuration will be sufficient in most cases when the following conditions are met:

• FTP and SFTP (but not FTPS) are to be enabled.
• The Access Anywhere node is attached directly to the network over which it will be accessed or, if a network device such as a firewall connects Access Anywhere host to the network over which it will be accessed, then Access Anywhere's address is NATed or PATed directly to an external address using a one-to-one mapping.
• The Access Anywhere node has egress access to the public internet.
• The default ports and ranges for FTP and SFTP are acceptable.

To trigger automatic configuration, start CloudFTP for the first time by running the following as the root user:

cd /var/www/smestorage/containers/cloudftp/
docker-compose up -d

Cloud FTP file transfer services (FTP, FTPS, SFTP) are disabled by default for new installations and for upgrades. Upon starting Cloud FTP, FTP and SFTP will become enabled. Additional steps are required to enable FTPS.

The Cloud FTP file transfer services, their default ports and their default states when CloudFTP has been started without additional configuration are:

Access Anywhere's firewall is pre-configured to support use of these services over these ports.

CloudFTP is managed by the root user. All commands must be run as root from the following directory:

/var/www/smestorage/containers/cloudftp

To start the file transfer services, run:

docker-compose up -d

To stop the CloudFTP file transfer services, run:

docker-compose down

To restart the services, run:

docker-compose restart

CloudFTP is a wrapper service that turns the FTP, FTPS and SFTP file transfer services on and off. You can explicitly control which of the three will be turned on by CloudFTP by setting the value of the:

disable_<service_name>

variable for each of the three services in the appropriate configuration file (configuration files are discussed in later sections). A value of '0' disables the file transfer service; a value of '1' enables it. Restart CloudFTP after changing the value of any of those variables to ensure that the service change takes effect.

You can use Access Anywhere's domain name to access any or all of the file transfer services. You can also add different domain names or FQDNs for any or all of the file transfer services. For example, if your Access Anywhere i's domain name is:

• example.com

you might choose to add:

• ftp.example.com

for FTP and/or:

• ftp_example.com

for FTPS.

To use a new domain name just add type A or CNAME record to DNS associating the new domain name with your Access Anywhere. Any valid domain name can be used; the file transfer services do not validate domain names.

If any of the criteria from the automatic configuration section above is not met, it will be necessary to manually update the configuration.

To access the FTP configuration file, which is used to configure FTP, FTP with TLS and FTPS, log into Access Anywhere and elevate to root.

The file ftpserver.conf contains many FTP, FTP w/TLS, and FTPS settings. It can be found at:

/var/www/smestorage/containers/cloudftp/configs/ftpserver.conf

Defaults:

Since the CloudFTP services log to stdout (standard-out), log files can be observed with:

cd /var/www/smestorage/containers/cloudftp
docker compose logs

To see recent and future log messages:

docker compose logs --tail=200 -f

The main element of automatic configuration is detection of the server's user facing (that is, public) IP address. This IP address is needed by CloudFTP to allow FTP clients to open Passive connections with the FTP or FTPS file transfer services.

The automatic configuration process uses a public service to detect Access Anywhere's public IP address. It will run the following command.

dig +short myip.opendns.com @resolver1.opendns.com

This command will timeout or fail if it cannot reach Access Anywhere. Also, in certain configurations it can return an incorrect IP address.

If it is necessary to set the Passive IP address manually, working as root edit the FTP server configuration file as follows:

vim /var/www/smestorage/containers/cloudftp/configs/ftpserver.conf

Find the line “external_ip_for_passive_mode” like follows and adjust the IP address

external_ip_for_passive_mode=1.2.3.4

Save, and exit the file, and relaunch the CloudFTP services as follows:

cd /var/www/smestorage/containers/cloudftp
docker-compose restart

Systems publicly exposing FTP based protocols might need additional setup to meet security requirements. NAA common types of changes are detailed below; for help with other advanced changes contact Support.

FTP with TLS and FTPS clients are not as strict as web browsers when using self signed certificates. Regardless, if a client requires a properly signed certificate the process is as follows:

Move the certificate and private key to the following locations:

/var/www/smestorage/containers/cloudftp/certs/localhost.crt  (certificate)
/var/www/smestorage/containers/cloudftp/certs/localhost.key  (private key)

Then restart CloudFTP.

FTP Passive Mode requires that the FTP server sends the client the port and IP address of Access Anywhere. When Access Anywhere is secured behind a public firewall the internal IP address will most likely not match the public IP address. Set up passive mode as follows:

1. Update the following entry in /var/www/smestorage/containers/cloudftp/configs/ftpserver.conf

   a. external_ip_for_passive_mode=xxx.xxx.xxx.xxx

2. Restart the CloudFTP service

FTP and FTPS are configured to run on the standard default ports listed above. These can be changed if required.

To change the port numbers, edit the docker-compose yaml file:

vim /var/www/smestorage/containers/cloudftp/docker-compose.yml

Change the public ports to those that you require, for example to change the FTP port from 21 to 8821 find the ports section and edit both values corresponding to the new port number.

    ports:
      - "8821:8821"
      - "990:990"
      - "20000-20010:20000-20010"

After saving the docker-compose.yml, edit the FTP server configuration file:

/var/www/smestorage/containers/cloudftp/configs/ftpserver.conf

to reflect the port as well, for example:

# Port where CloudFTP Should Be Listening
port=8821

Finally, restart the CloudFTP services and verify the configuration.

Note: External firewalls, load balancers and/or NAT/PAT configurations may also need to be updated to pass traffic on the new port(s) to Access Anywhere.

The rates at which FTP and FTPS write to disk, downloads data and upload data can be limited through configuration. Update the following entries in ftpserver.conf and restart CloudFTP service to enable rate limiting. Value are in bytes per second:

max_speed_write_to_disk=2097152    
max_download_speed=3145728  
max_upload_speed=3145728

The maximum number of concurrent FTP and FTPS connections allowed for each user can be limited through configuration. Update the following entry in ftpserver.conf and restart CloudFTP service to enable rate limiting.

limitConnectionsForOneUser=5

See list further up in this page above for additional configuration settings.

To access the sftp configuration files log into Access Anywhere and elevate to root.

The file sftpserver.conf contains many SFTP settings. It can be found in: /var/www/smestorage/containers/cloudftp/configs/sftpserver.conf

Defaults:

Since the CloudFTP services log to stdout (standard-out), log files can be observed with:

docker-compose logs cloudsftp

To obtain the last 200 log lines, run

docker-compose logs --tail=200 cloudsftp

The SFTP service self-generates SSH keys in order to serve the SFTP connection.

In most cases there is no need to be concerned by this. If you would like to supply your own SSH keys, these can be dropped in at the following location:

/var/www/smestorage/containers/cloudftp/keys/ssh_host_rsa_key   (private key)
/var/www/smestorage/containers/cloudftp/keys/ssh_host_rsa_key.pub   (public key)

Unique SSH Keys are generated on first startup, so you do not necessarily have to regenerate the keys.

If you want to generate the keys, delete the existing keys from /var/www/smestorage/containers/cloudftp/keys/ and restart the CloudFTP service. New keys will be created in this location automatically.

By default SFTP is set to use port 2200. This can be changed to another port, but to change SFTP to the its well known value of port 22, SSH must be moved to another port.

As root user edit the following file: /etc/ssh/sshd_config Uncomment the line highlighted in yellow and change port number to a new number such as 2222

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

After saving the file run the following command to let SELinux know of the change. Substitute the selected port number for the text in yellow ( #PORTNUMBER)

semanage port -a -t ssh_port_t -p tcp #PORTNUMBER 

Changing port numbers also requires firewall changes to IP tables. Edit /etc/sysconfig/iptables

Change the entry highlighted in yellow to the new SSH port.TODO Yellow
Change the entry highlighted in red to the new SFTP port TODO Red

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 990 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 20001:20100 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 990 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2200 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

Restart iptables and SSH with the following command:

systemctl restart iptables
systemctl restart sshd

Before moving on, open a new ssh connection to Access Anywhere using the new port number. Ensure connectivity is functioning on the new port before closing the existing session or moving on.

Edit docker-compose.yml in /var/www/smestorage/containers/cloudftp/
Change line with SFTP port 2200 to the new value and save.

    ports:
      - "2200:2200"

Next edit the SFTP config file in /var/www/smestorage/containers/cloudftp/configs/sftpserver.conf and update the port number there as well.

Finally, restart CloudFTP services as described above and test service.

The rates at which SFTP writes to disk, downloads data and uploads data can be limited through configuration. Update the following entries in sftpserver.conf and restart CloudFTP service to enable rate limiting. Value are in bytes per second:

max_speed_write_to_disk=2097152    
max_download_speed=3145728  
max_upload_speed=3145728

The maximum number of concurrent SFTP connections allowed for each user can be limited through configuration. Update the following entry in sftpserver.conf and restart CloudFTP service to enable rate limiting.

limitConnectionsForOneUser=5

See list further up in this page above for additional configuration settings.

The activity log for Cloud SFTP can be found at:

 /var/www/smestorage/ftpserver/sftpserver/log.txt

FTP, FTPS and SFTP uploads all may sometimes require scratch space. Scratch space is needed if the uploaded client cannot or does not tell CloudFTP the size of the file that will be uploaded, for example when the client is a camera that is streaming a live recording. Many popular clients don't inform the server (CloudFTP in this case) of the size of the file that is being uploaded even when that information is available to them.

Available scratch space should be large enough to accommodate the largest permitted upload file size multiplied by the number of permitted concurrent uploads (countprocesses * maximumlimitsizeupload).

Scratch space is configured in the service configuration files like this: for SFTP (note the uppercase 'F'):

tmpFolder=<path-to_temp_folder>

and like this for FTP and FTPS:

tmpfolder=<path-to_temp_folder>

By default these are set to /scratch/cloudftp. To increase available disk space for scratch you can set the path to a different location or you can optionally mount a large volume at the default location.