CloudFTP, CloudSFTP and CloudFTPS Configuration

Access Anywhere supports a number of protocol gateways allowing applications to natively access Access Anywhere using FTP/FTPS, SFTP or WebDAV. These are ideal for retrofitting existing applications remote access to Nasuni storage.

This document covers the configuration of the appliance FTP/SFTP and FTPS gateways. For information on the configuration of clients see Cloud FTP. See also:

• Cloud FTP
• Appliance Troubleshooting

In the example below, the domain name is perf.smestorage.com.

The services will be available at the following ports:

All firewall settings are already configured for the default basic configuration.

The Access Anywhere's FTP/FTPS/SFTP service may not be enabled on installation. To ensure that it is turned on and enabled, log in as smeconfiguser then become root and enable and start the service:

su -
systemctl enable cloudftp
systemctl start cloudftp 

To disable Access Anywhere's FTP/FTPS/SFTP service, first log in as smeconfiguser and then become root. The following commmands stop the service and then mark it as disabled so it does not start on reboot.

systemctl stop cloudftp 
systemctl disable cloudftp

CloudFTP can be accessed using Access Anywhere's FQDN. Some customers may choose to create an additional FQDN for use by FTP clients, for example ftp.myfilefabric.com.

Since version 1901, Access Anywhere license keys have been bound to the FQDNs by which Access Anywhere is accessed. Before client programs can use the additional FQDN, you must obtain from Support a license key in which the FQDN has been encoded, and install that key on your Access Anywhere.

All Cloud FTP services (FTP/FTPS, SFTP) can be restarted when logging in as root via systemctl.

Log in as smeconfiguser then become root

su -
systemctl stop cloudftp
systemctl start cloudftp 
systemctl restart cloudftp 

(Use stop, start or restart depending as appropriate.)

Systems publicly exposing FTP based protocols might need additional setup to meet the needs of security administrators. Common changes are detailed below, for advanced changes contact Support.

To access the ftp configuration files log into Access Anywhere as smeconfiguser and elevate to root using the command:

su -

The file ftpserver.conf contains many FTP, FTP w/TLS, and FTPS settings. It can be found at:

/var/www/smestorage/ftpserver/ftpserver.conf

Defaults:

The Activity Log for CloudFTP and CloudFTPS can be found at:

 /var/www/smestorage/ftpserver/ftpserver.log

To access the ftp server via a custom domain name instead of the one configured for the appliance create an A or CNAME DNS record pointing to the IP address or domain name of the appliance. Any fully-qualified domain name can be used - Access Anywhere FTP services do not validate.

FTP w/TLS and FTPS clients are not as strict as web browsers when using self signed certificates. Regardless, if a client needs to use a properly signed certificate the process is as follows:

1. Upload certificate public and private key to Access Anywhere, preferably in the following directories

   a. Private key in /etc/pki/tls/private/
   b. Ordered List ItemPublic key in =/etc/pki/tls/certs/

2. Update ftpserver.conf entries
   a. pathToSSLkey should point to the private key
   b. pathToSSLcert should point to the public certificate
   
3. Restart CloudFTP service

FTP Passive Mode requires that the FTP server sends the client the port and IP address of Access Anywhere. When Access Anywhere is secured behind a public firewall the internal IP address will most likely not match the public IP address. Set up passive mode as follows:

1. Add the following entry to ftpserver.conf

   a. external_ip_for_passive_mode=xxx.xxx.xxx.xxx

2. Restart CloudFTP service

FTP Passive Mode ports are defaulted to TCP 20001 – 20100

Changing these port numbers in ftpserver.conf also requires firewall changes to IP tables.

After changing min_port & max_port, restart CloudFTP service.

Then alter /etc/sysconfig/iptables

Change the range highlighted in yellow to the new port range: TODO yellow

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 990 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 20001:20100 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 990 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2200 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

Restart IPtables with the following command:

systemctl restart iptables

FTP is defaulted to TCP port 21 and FTPS is defaulted to port 990
Changing these port numbers in ftpserver.conf also requires firewall changes to IP tables.
After changing port or FTPISport, restart CloudFTP service. Then alter /etc/sysconfig/iptables
Change the range highlighted in yellow to the new port range:TODO Yellow

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 990 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 20001:20100 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 990 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2200 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

Restart IPtables with the following command:

systemctl restart iptables

FTP & FTPS can be rate limited both to disk and via networking bandwidth. Add the following entries to ftpserver.conf and restart CloudFTP service to enable rate limiting. Value are in bytes per second:

max_speed_write_to_disk=2097152
max_download_speed=3145728
max_upload_speed=3145728

FTP and FTPS uploads sometimes require scratch space. Scratch space is needed if the uploaded client cannot or does not tell CloudFTP the size of the file that will be uploaded, for example when the client is a camera that is streaming a live recording. Many popular FTP clients don't inform the FTP server (CloudFTP in this case) of the size of the file that is being uploaded even when that information is available to them.

Available scratch space should be large enough to accommodate the largest permitted upload file size multiplied by the number of permitted concurrent uploads (countprocesses * maximumlimitsizeupload).

Scratch space defaults to the temp folder in /var/www/smestorage/tmp but can be changed by adding the following entry to ftpserver.conf and restarting the service.

tmpfolder=/path/to/target/

The Activity Log for CloudSFTP can be found at:

 /var/www/smestorage/ftpserver/sftpserver/log.txt

Systems publicly exposing SFTP based protocols might need additional setup to meet the needs of security administrations. Common changes are detailed below, for advanced changes contact Support.

To access the sftp configuration files log into Access Anywhere as smeconfiguser and elevate to root using the command:

su -

The file sftpserver.conf contains many SFTP settings. It can be found in: /var/www/smestorage/ftpserver/sftpserver/

Defaults:

To access the SFTP server via a custom FQDN instead of the system FQDN nothing needs to be done other than registering A or CNAME DNS records to point to the IP address of Access Anywhere. The Access Anywhere SFTP service does not check the FQDN and thus any FQDN can be used.

It is recommended to generate new secure keys for the SFTP server.

As the root user

cd /var/www/smestorage/
ssh-keygen -t rsa -f "./ssh_host_rsa_key"    #(don't enter any passphrase)
chown smestorage:smestorage ssh_host_*

This will generate 2 files sshhostrsakey and sshhostrsakey.pub Edit sftpserver.conf file and change the 2 lines as below:

pathToKey=/var/www/smestorage/ssh_host_rsa_key
pathToCert=/var/www/smestorage/ssh_host_rsa_key.pub

SFTP is set to 2200. This can be changed to another port, but if the desire is to change SFTP to the default port of 22, SSH must be moved to another port.

As root user edit the following file: /etc/ssh/sshd_config Uncomment the line highlighted in yellow and change port number to a new number such as 2222 TODO Yellow

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

After saving the file run the following command to let SELinux know of the change. Substitute the selected port number for the text in yellow ( #PORTNUMBER) TODO Yellow

semanage port -a -t ssh_port_t -p tcp #PORTNUMBER 

Changing port numbers also requires firewall changes to IP tables. Edit /etc/sysconfig/iptables

Change the entry highlighted in yellow to the new SSH port.TODO Yellow
Change the entry highlighted in red to the new SFTP port TODO Red

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 990 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 1024: --dport 20001:20100 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 990 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2200 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

Restart IPtables and SSH with the following command:

systemctl restart iptables
systemctl restart sshd

Before moving on, open a new ssh connection to Access Anywhere using the new port number. Ensure connectivity is functioning on the new port before closing the existing session or moving on.

Edit sftpserver.conf in /var/www/smestorage/ftpserver/sftpserver
Change line port=2200 to the new value and save.
Restart CloudFTP service

FTP & FTPS can be rate limited both to disk and via networking bandwidth. Add the following entries to ftpserver.conf and restart CloudFTP service to enable rate limiting. Value are in bytes per second:

max_speed_write_to_disk=2097152    
max_download_speed=3145728  
max_upload_speed=3145728
limitConnectionsForOneUser=5

See list at the top of this page above for additional configuration settings.

SFTP sometimes require scratch space. Scratch space is need for example during an SFTP stream from a camera or device that is recording live and does not yet know the size of the file. As such scratch space must be larger than the largest upload size in bytes that will be permitted.

Scratch space defaults to the temp folder in /var/www/smestorage/tmp but can be changed by adding the following entry to sftpserver.conf and restarting the CloudFTP service.

tmpfolder=/path/to/target/