Remote access to SFTP server...

Question

Remote access to SFTP server...

I'm working with an OS X Server (5.0.4) and I want to set up a SFTP server that users can access remotely.

I've turned on the FTP service, and that is working wonderfully inside of the office. I've got them set up on a dDNS, and that's working wonderfully and resolving well. Other than port forwarding, what's next?

Also... I have a feeling I'm not understanding something. I think I'm setting up an FTP service. How do I make certain it is the more secure SFTP? Again, this is for remote access, not local.

Thank you in advanced for any help.

Posted on Jan 3, 2018 11:29 AM

Reply

Answer 1

MrHoffman

Level 10

145,915 points

Jan 8, 2018 10:14 AM in response to phospholipid77

Whatever client is in use has not had the usual ssh directories set up. No keys were established, so that failure isn’t a surprise. Since it’s a server, make sure the target user is permitted ssh access; explicitly added or in an existing and permitted group for ssh access. See the Service Access Control List support (SACL).

https://help.apple.com/serverapp/mac/5.4/#/apd21a2ffdaa

There’s more to keepijg a server secure and locked down. Assuming the Duplicati package encrypts the data using AES and decent passwords, then that backup data can be stored anywhere, safely. I’d not generally prefer to open up remote access into this server. That makes for a much more complex environment to manage, and ine that risks all of the local data, not just an (encrypted) backup.

Reply

Answer 2

MrHoffman

Level 10

145,915 points

Jan 5, 2018 2:32 PM in response to phospholipid77

Please go ask the Duplicati folks?

I am unfamiliar with Microsoft Windows, and with Duplicati, which is the bulk of this question. The other hunk here involves the details of the particular network firewall box in use here; those vary widely.

As for macOS and for enabling and allowing remote sftp access, get that working locally, then open up TCP port 22 at the firewall and set up port forwarding from the firewall to the server, test remotely, and have at.

Make certain all your passwords on all of your accounts are secure.

Set up DDNS at your network firewall (and that associated with your account with your preferred DDNS provider), or get static IP and DNS, and use that for remote references into your systems.

Hope that your ISP doesn’t block TCP port 22, too. Some do.

Opening TCP port 22 also allows remote ssh access by default; command-line access to the target system. See the previous response for details.

How Duplicati is configured for sftp, I don’t know.

You’re really not centrally asking a macOS Server question here. This is mostly an IP networking question, and particularly with configuring and managing Duplicati on Windows, and setting up rules on your network firewall. Get that configured and working to an arbitrary sftp server, and then get macOS configured as that arbitrary server.

Reply

Answer 3

Jan 4, 2018 5:48 PM in response to MrHoffman

This is all really valuable insight.

I'm wondering if I tell you what the situation is, if you might have some advice.

Currently, in our office, there are five people on Windows who use Duplicati to backup to an OSX server locally via FTP. Two of those people are leaving town for several months. They want to be able to run backups remotely while they're gone. Yes, Dropbox, and yes, Google Drive... that's not what they want. They want to be able to run the same backups they do now, to the OSX server in their office, except while they are out of town. Ideally this would be automatically without them having to fuss a whole lot.

I thought if I just set up a dDNS with like duckdns.org or something, and forwarded the ports, I could make the local FTP accessible to them remotely, change their target address in Duplicati, and all would be well.

Is there a better option within these parameters?

Reply

Answer 4

Jan 5, 2018 11:02 AM in response to MrHoffman

So, it's pretty clear to me that I won't be using FTP.

Duplicati is really open. I can use just about any protocol I want. I'm not going to use Backblaze because they want everything in house. That means I have to use the OSX server as my terget. That's just the parameters I am to work with. So...

Assuming I can make Duplicati target the OSX server any way I want, what is the best way to do that? I'm guessing setting up a VPN server is the best route. Or sftp? Is that what you would say? If so, I can start working on that today, I think.

Reply

Answer 5

Jan 7, 2018 6:08 PM in response to MrHoffman

That's excellent. All of this help is exceptional.

Here were the steps I followed.

I enabled "remote login" in System Preferences to turn on ssh.

I forwarded port 22 to the computer's IP address.

I created a duckdns domain name for that computer.

When I'm on a remote client, like FileZilla or CyberDuck, I am able to get to the computer but there are some login issues.

With FileZilla, I get this notice:

Error:	Server sent an additional login prompt. You need to use the interactive login type.
Error:	Critical error: Could not connect to server

With CyberDuck, I get this notice:

"Broken transport; encountered EOF."

On FileZilla, when I use the "interactive login type" it asks me for the password with a dialogue box. Then it asks me again right away. The first time, it says it wants the "SSH server authentication" and the second time it says it wants the "SSH password".

I know the password and server are correct, and I get clear indications that the DNS is working. There must be something else I'm missing, likely on the server side. Some setting or flag or something I need to enable...

¯\_😕_/¯

Reply

Answer 6

Jan 8, 2018 2:49 PM in response to MrHoffman

So, would I follow a site like this one to make keys? I'm guessing I make the key client-side and then put a copy on the server, right? If I make a key in an OSX client and then put it in the OSX server, can I simply copy that same key into the Windows machine?

I want to make this work just so that I learn and know that I have accomplished something. In the meanwhile, I'm looking for another remote upload because I have to make this work by Wednesday. 😟

Reply

Answer 7

Jan 8, 2018 2:52 PM in response to phospholipid77

I just feel like there must be some other way to use this particular OSX Server as a target for remote file access. I am open to *any* other suggestions. Duplicati isn't the weak point here. Duplicati can use literally almost any convention you throw at it. The weak point is, clearly, myself and what I know/don't know.

Reply

Answer 8

Jan 8, 2018 3:07 PM in response to phospholipid77

I think I'm missing something *very* basic here.

I just tried to SSH into the server locally by using a local IP address. This is what happens:

colecovision:~ jaime$ ssh USER@10.0.1.77

Password: [I enter USER's password at this point and get this prompt:]

USER@10.0.1.77's password: [I enter USER's password at this point and get this response]

Authentication failed.

colecovision:~ jaime$

I tried to enter the password for user "jaime" in that first prompt. It gives me three tries, then gives me the second password prompt, then kicks me.

Does the test USER somehow have two separate passwords? Is there a second password I don't know about?

Reply

Answer 9

MrHoffman

Level 10

145,915 points

Jan 7, 2018 8:36 PM in response to phospholipid77

Ah, the GUI. Forget the GUI. Use the ssh client directly. From a remote macOS or BSD or Linux system, launch Terminal.app or analogous, and then ssh -vvv user@example.com, where user is the target username and example.com is the target host name or (better) the external IP address of the server.

Review the ssh -vvv diagnostic output for any sensitive details, and then post it here or to one of the other text-hosting sites.

Older packages may not connect to macOS server (or to other current systems) due to upgrades in security requirements in recent releases.

if you must use Windows for testing, make sure it’s Windows 10 with the most recent updates loaded and with the ssh client installed. (Shouldn't be running anything prior to 10 at this point anyway.). The ssh support is an optional part of the most recent Windows betas. Much like Windows, I’m also not familiar with PuTTY, but that too can connect via ssh.

Hosting the backups remotely reduces the risk to your server, and will likely be esiser to configure and maintain, too.

Reply

Answer 10

Jan 7, 2018 8:54 PM in response to MrHoffman

So, when I run ssh -vvv, this is what I get back (it ends with "authentication failed"):

Last login: Sat Jan 6 20:54:43 on ttys000

colecovision:~ desktopuser$ ssh -vvv SSHUSER@SFTPSERVER.COM

OpenSSH_7.4p1, LibreSSL 2.5.0

debug1: Reading configuration data /etc/ssh/ssh_config

debug2: resolving "SFTPSERVER.COM" port 22

debug2: ssh_connect_direct: needpriv 0

debug1: Connecting to SFTPSERVER.COM [xxx.xxx.xxx.x] port 22.

debug1: Connection established.