FTP/SFTP Configuration

The File Fabric Appliance and SaaS support a number of protocol gateways allowing applications to natively access the File Fabric using FTP/FTPS, SFTP or WebDAV. These are ideal for retrofitting existing applications for object storage.

This document covers the configuration of the appliance FTP/SFTP and FTPS gateways. For information on the configuration of clients see cloudftp.

Applies to:

• Enterprise File Fabric Appliance

See also:

• cloudftp
• Appliance Troubleshooting

Setting the domain name during Appliance Installation allows all three services be be accessed through the domain name.

In the example below, the domain name is perf.smestorage.com.

The services will be available at the following ports:

All firewall settings are already configured for the default basic configuration.

All Cloud FTP services (FTP/FTPS, SFTP) can be restarted when logging in as root via systemctl.

Log in as smeconfiguser then become root

su -
systemctl stop cloudftp
systemctl start cloudftp 
systemctl restart cloudftp 

Systems publicly exposing FTP based protocols might need additional setup to meet the needs of security administrations. Common changes are detailed below, for advanced changes contact SME Support.

To access the ftp configuration files log into the File Fabric as smeconfiguser and elevate to root using the command:

su -

The file ftpserver.conf contains all FTP, FTP w/TLS, and FTPS settings. It can be found at:

/var/www/smestorage/ftpserver/ftpserver.conf

Defaults:

To access the ftp server via a custom domain name instead of the one configured for the appliance create an A or CNAME DNS record pointing to the IP address or domain name of the appliance. Any fully-qualified domain name can be used - the File Fabric FTP services do not validate.

FTP w/TLS and FTPS clients are not as strict as web browsers when using self signed certificates. Regardless, if a client needs to use a properly signed certificate the process is as follows:

1. Upload certificate public and private key to File Fabric, preferably in the following directories

   a. Private key in /etc/pki/tls/private/
   b. Ordered List ItemPublic key in =/etc/pki/tls/certs/

2. Update ftpserver.conf entries
   a. pathToSSLkey should point to the private key
   b. pathToSSLcert should point to the public certificate
   
3. Restart CloudFTP service

FTP Passive Mode requires that the FTP server sends the client the port and IP address of File Fabric. When File Fabric is secured behind a public firewall the internal IP address will most likely not match the public IP address. Set up passive mode as follows:

1. Add the following entry to ftpserver.conf

   a. external_ip_for_passive_mode=xxx.xxx.xxx.xxx

2. Restart CloudFTP service

FTP Passive Mode ports are defaulted to TCP 20001 – 20100

Changing these port numbers in ftpserver.conf also requires firewall changes to IP tables.

After changing min_port & max_port, restart CloudFTP service.

Then alter /etc/sysconfig/iptables

Change the range highlighted in yellow to the new port range: TODO yellow

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 990 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 20001:20100 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 990 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2200 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

Restart IPtables with the following command:

systemctl restart iptables

FTP is defaulted to TCP port 21 and FTPS is defaulted to port 990
Changing these port numbers in ftpserver.conf also requires firewall changes to IP tables.
After changing port or FTPISport, restart CloudFTP service. Then alter /etc/sysconfig/iptables
Change the range highlighted in yellow to the new port range:TODO Yellow

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 990 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 20001:20100 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 990 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2200 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

Restart IPtables with the following command:

systemctl restart iptables

FTP & FTPS can be rate limited both to disk and via networking bandwidth. Add the following entries to ftpserver.conf and restart CloudFTP service to enable rate limiting. Value are in bytes per second:

max_speed_write_to_disk=2097152
max_download_speed=3145728
max_upload_speed=3145728

FTP & FTPS sometimes require scratch space. Scratch space is need for example during an FTP stream from a camera or device that is recording live and does not yet know the size of the file. As such scratch space must be larger than the largest filesize that will be permitted.

Scratch space defaults to the temp folder in /var/www/smestorage/tmp but can be changed by adding the following entry to ftpserver.conf and restarting the service.

tmpfolder=/path/to/target/

Systems publicly exposing SFTP based protocols might need additional setup to meet the needs of security administrations. Common changes are detailed below, for advanced changes contact SME Support.

To access the ftp configuration files log into the File Fabric as smeconfiguser and elevate to root using the command:

su -

The file sftpserver.conf contains all SFTP settings. It can be found in: /var/www/smestorage/ftpserver/sftpserver/

Defaults:

To access the SFTP server via a custom FQDN instead of the system FQDN nothing needs to be done other than registering A or CNAME DNS records to point to the IP address of the File Fabric. The File Fabric SFTP service does not check the FQDN and thus any FQDN can be used.

It is recommended to generate new secure keys for the SFTP server.

As the root user

cd /var/www/smestorage/ftpserver/sftpserver/
ssh-keygen -t rsa -f "./ssh_host_rsa_key"    #(don't enter any passphrase)
chown smestorage:smestorage ssh_host_*

This will generate 2 files sshhostrsakey and sshhostrsakey.pub Edit sftpserver.conf file and change the 2 lines as below:

pathToKey=ssh_host_rsa_key
pathToCert=ssh_host_rsa_key.pub

SFTP is set to 2200. This can be changed to another port, but if the desire is to change SFTP to the default port of 22, SSH must be moved to another port.

As root user edit the following file: /etc/ssh/sshd_config Uncomment the line highlighted in yellow and change port number to a new number such as 2222 TODO Yellow

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

After saving the file run the following command to let SELinux know of the change. Substitute the selected port number for the text in yellow ( #PORTNUMBER) TODO Yellow

semanage port -a -t ssh_port_t -p tcp #PORTNUMBER 

Changing port numbers also requires firewall changes to IP tables. Edit /etc/sysconfig/iptables

Change the entry highlighted in yellow to the new SSH port.TODO Yellow
Change the entry highlighted in red to the new SFTP port TODO Red

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 990 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 20001:20100 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 990 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2200 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

Restart IPtables and SSH with the following command:

systemctl restart iptables
systemctl restart sshd

Before moving on, open a new ssh connection to the file fabric using the new port number. Ensure connectivity is functioning on the new port before closing the existing session or moving on.

Edit sftpserver.conf in /var/www/smestorage/ftpserver/sftpserver
Change line port=2200 to the new value and save.
Restart CloudFTP service

FTP & FTPS can be rate limited both to disk and via networking bandwidth. Add the following entries to ftpserver.conf and restart CloudFTP service to enable rate limiting. Value are in bytes per second:

max_speed_write_to_disk=2097152    
max_download_speed=3145728  
max_upload_speed=3145728

SFTP sometimes require scratch space. Scratch space is need for example during an SFTP stream from a camera or device that is recording live and does not yet know the size of the file. As such scratch space must be larger than the largest upload size in bytes that will be permitted.

Scratch space defaults to the temp folder in /var/www/smestorage/tmp but can be changed by adding the following entry to sftpserver.conf and restarting the CloudFTP service.

tmpfolder=/path/to/target/