SFTP on FreeNAS install

Trying to use FreeNAS as the server, there are settings / checkboxes that claim SFTP works on this OS but I am really starting to not believe it. The docs say (if memory serves me) that I just need to enable SSH and FTP and they almost automagically just work with each other. Well I've tried that, and that's crap.

Under Services > FTP:
Local Users Only is checked
Default Root (chroot() ) is enabled to keep clients from wandering
TLS/SSL is unchecked

Under Services > SSH:
Permit Root Login is disabled
Password Auth is enabled
TCP Forwarding is checked (states that this enables SSH tunneling)
Compression is disabled
I have generated a private key and it's in place in the gui here.

The object is to be able to receive sensitive files via SFTP over the internet, the domain is leased / owned whatever you want to call it so ftp.mydomain.com will be forwarded to a static IP, then that static IP will have port forwarding to the physical server.
Right now the SFTP client WinSCP was erroring out with an error about no SFTP service running or this is not an SFTP server... something to that effect.

I've generated a private key with openssl which seems to work for the server, but when you try to use it with WinSCP - the client wants a .ppk version not a PEM file.

I can't seem to find a good tutorial anywhere from beginning to end. Right now I'm just trying to test functionality on a class C 24 bit network. Can anyone provide some helpful advice or maybe recommend a better solution? I like FreeNAS because if I were to present this solution to a company, the web GUI interface would make it very easy for them to add / remove users as they get more clients.

SFTP has nothing to do with FTP. SFTP is a function of openssh.

Since it's just FreeBSD with a couple of extra scripts, edit /etc/ssh/sshd_config. Look for Subsystem somewhere at the bottom.

Code:

---

# override default of no subsystems
Subsystem      sftp    /usr/libexec/sftp-server

---

This enables SFTP.

Use PuTTYgen to generate a key for WinSCP. Load that key in Pageant and both PuTTY and WinSCP will use it.

So if SFTP is SSH... should I have SFTP running on port 21? or port 22?

Thanks for the help!

It's a function of SSH, so it runs on the same port.

Thanks sir dice, so... if I were setting this up for users with less technical knowledge ya think it would be a good idea to move the ssh port to 21 instead of leaving it at 22?

No, that would only confuse things. SFTP has nothing to do with FTP.

So if you set an FTP client to use SFTP it will look for port 22 by default?
Any suggestions for SFTP clients?

Quote:

---

Originally Posted by blakdeth77

So if you set an FTP client to use SFTP it will look for port 22 by default?

---

That depends on the client. Some call FTP over SSL also SFTP. But that works completely different.

Quote:

---

Any suggestions for SFTP clients?

---

Yes, WinSCP. Works really nice in combination with PuTTY.

If you have this server open to the outside, I would highly recommend using key-based authentication. [actually even if it isn't open to the outside, I would recommend that.] As long as you have SSH set up properly, SFTP should work. SirDice hit it on the head. It has nothing to do with standard FTP. It allows you to transfer files utilizing SSH's encryption. Everything will go over port 22.

Quote:

---

Originally Posted by westin

If you have this server open to the outside, I would highly recommend using key-based authentication. [actually even if it isn't open to the outside, I would recommend that.] As long as you have SSH set up properly, SFTP should work. SirDice hit it on the head. It has nothing to do with standard FTP. It allows you to transfer files utilizing SSH's encryption. Everything will go over port 22.

---

Yeah, the key thing is becoming another whole headache for me. I tried using openssl or something like that on a fedora box I have. So far if the FreeNAS box likes the key, the WinSCP program does not (even after using the putty program to change the key to a ppk(?) file)... I guess I need to search for a tutorial or something to get the key stuff straightened out.

Since you are playing with this to learn it maybe I can clear up a few things, more down and dirty approach though because I have never used a GUI with sshd. Once you know how it works maybe you can streamline things. Start by just getting ssh to work. I am assuming you know how to get around *nix with a CLI ?


1) Forget anything about openssl ... different animal as SirDice said.

2) in your setup of SSH you have PasswordAuthentication enabled. As westin said, that is not the most secure. Disable it!

3) you'll want to set up a public/private key for the client, using the client
( puttygen.exe if the clients will be windows boxes. )
( note: you should always insist the users create a passphrase for the key, and make sure they NEVER forget it! Otherwise they will have to make a new key and you will have to revoke the old one from the server. )

you will then copy the client's public key to the server and put it in the user's home directory.
Example: once the public key is transferred over to the server, use something like
ssh-keygen -i -f ( file name of the key ) > /home/user/.ssh/authorized_keys
( if you are going to be importing more keys for that user, you will have to use >> instead of > for future keys so you append and do not overwrite the original file.)
Also, you should verify the permissions of the file ( should be 600 )

If you can use their GUI to import the public key into the ssh server instead of my way you might try that ( again I have never used FreeNAS ) but the important thing is the private key stays on the client, the public key gets imported to the server.

you should now be able to log into the server from the client ( using something like Putty )

If this is all working, now you can go ahead and check the Subsystem option in sshd_config as SirDice said. As I am unfamiliar with FreeNAS I do not know if it is enabled by default when you enabled the ssh daemon.



Since the server is going to be behind a firewall, and access will be from the Internet, you might set up the clients to connect to a high number port, then forward that port on the firewall to the ssh server port 22! ( you can change port 22 to whatever if the server is going to located in a congested local network too, using the sshd_config. ) Just take one step at a time, making sure each one is working before going to the next. Just remember, if you do forward the port on the firewall and then try to connect from inside the perimeter, you will need to connect to port 22 from inside ( or whatever port you chose ) and not the one clients from outside use.


Oh, and make sure you turn off that damn FTP service !!!!!

BTW, putty generated keys can be converted if you want to use them in a *nix ssh client, just see the documentation for puttygen. If you don't understand that, just ignore it, it might be more confusing, but useful if your client dual boots.

Maybe you could make that beginning to end tutorial??

Thank you very much for the head start... I'll start a tutorial when I continue working on this project. should be later this week. I'll shoot for some cropped screenshots and everything.

:-D