At worked today I needed to setup a secure ftp site. My normal job is to writing software but our company is small so I end up doing IT type work from time to time.
I have an server that the three or four engineers at my job use for subversion, email testing and other engineering tasks. It was decided (not by me) that we needed to have an sftp server running on this machine to handle some customer requirements.
I have a weakness that I need to really to improve on. I always look for free software before I look for commercial software. In most cases this ends up costing me more time that it’s worth but I haven’t been able to break the habit. I think the problem is that there is some fantastic free software out there. I have always been a fan of Apache and MySQL, not to mention the software that this blog is running on. (WordPress).
On the otherhand there’s software out there that works really well but, unless I’m going to work with it all the time, just isn’t worth my time. Sendmail is an example. As long as you don’t need to configure or change anything it’s fine. Otherwise I’d rather spend $200 on a mail package like Merak that cuts out all the required Unix geekery. The biggest problem I had with Sendmail is that if I had to add a user 6 months after I installed Sendmail, I always spent too much time reading Sendmail documentation. (maybe it’s better these days, I haven’t used sendmail in about 7 years).
To get back to today’s issue, I spent about 4 hours trying to get OpenSSH setup to use as an sftp server. An hour of the time was spent with me trying to get the firewalls set up. (I had forgotten that in addition to a hardware firewall our Windows 2003 server has a software firewall running). In about 45 minutes or so I had OpenSSH working with 2 users set to use 2 different directories. I thought I had the problem solved.
Then I performed a few tests. I ran into two problems. One was that OpenSSH is shell program. I didn’t want people to be able to shell into the machine, I only wanted secure ftp. It took me about 30 or 40 minutes to figure out how to get around this problem. I found a small bash shell script that I ran instead of the normal shell program when someone logged in.
The second problem was that when someone logged in they could navigate to any drive or directory on the machine. I probably spent 2 hours trying to get around this. If I had been on a Unix server I could have done something called a ‘jail chroot’, This basically makes the root directory equal to the user’s directory when they log in. It keeps them from navigating to directories outside their own.
I could not figure out a way around this problem, but after spending way too much time researching on the internet, I know that this is a common problem that, it seems, no one has a good answer for.
So after spending 4 hours or so trying to get the free stuff to work, I spent 30 minutes searching for something commercial. I found CoreFTP. It was $50 and took me all of 15 minutes to setup. No need to write any scripts or mess with windows users or edit any config files.
The lessons that I think I should take from this are:
1. Spend more time thinking about and defining the requirements up front. The requirement given to me was ‘set up a sftp server’. I didn’t realize until an hour into this journey that I needed to restrict directories. I should have also realized that openSSH is shell. (duh).
2. Look for both commercial and free at the same time and pick the one that fits the requirements best and, for me, requires minimal installation effort.
This should be obvious. I wasted the better part of a day on this. One day I might learn my lesson because, y’know, I’d much rather write software than spend my day configuring and installing someone else’s.