SFTP over SSH

Is there a good Sun Guide onine that explains how to setup my Unix Solairs 10 system so I can SFTP using SSH from my Windows Clients to my Solairs Servers? Basically I can not use FTP so I understand their is a more secure what to transfer files so I'm assuming SFTP over SSH is the correct description.

Well, sftp is ran from within sshd, basically it runs an sftp command over an established ssh session, so i don't think you can prevent a user who can use sftp from using ssh.
I would think its enabled by default, if its not you can enable it by editing /etc/ssh/sshd_config
see 'man sftp-server', 'man sshd_config' as well as 'man sshd' for more details.
If your only goal is to have secure FTP-alike access to the system, you could look into FTPS, which is a more secure FTP which is separate from SSH.
AFAIK ftps is not supported by default in Solaris 10, but you can always download ProFTPD, which i used the last time i did something like this (which was a while ago). I recall ProFTPD being very reliable and easy to setup, and can definitely be setup in a way so it only allows the users to FTP securely into your system..
.7/M.

Similar Messages

Java Caps 5.1.3. and SFTP (FTP over SSH)

Hi,
I'm trying to use the BatchSFTP option from the batch eway to setup FTP over SSH. I'm having trouble in setting up the keyfile. I've generated a trusted_hosts file using openSSH via CYGWIN (I'm running on W2003 server). The error I get is: Batch SFTP eWay connection failed, method=[connect()], message=[Exception when connect(), e=java.io.IOException: Invalid SSH1 public key format].
Has anyone experience with FTP over SSH and can help me out on this.
Thank you very much,
Cor Zijlstra
[email protected]

You need to convert the server public key for the server that you are connecting with to the IETF SECSH format. If you have access to do that, you can run the command ssh-keygen -f myServerPublickey.pub -e > myIETFServerPublicKey.pub. Otherwise, your UNIX server admin will need to run that. Put the ITEF key in your .ssh directory and have CAPS reference that IETF format and you should be set. Make sure the connectivity map/env explorer is set to public key authentication.
I think there is a bug in CAPS with how it is handling the SSH formated key. I have been unable to prove it to support. Furthermore, more pressing issues have taken up my time (aka, other projects).
John

How to handle SFTP (ftp over SSH)

Hi there,
I know XI only supports FTP (and FTPS(SSL)) when trying to exchange files with other systems.
Right now, i have to interconnect a legacy with XI. This external server uses SFTP (FTP over SSH) as an standard of file transfering process.
Could you please tell me if there is a possibility to integrate them?
Best regards,
David

You'll need either to:
- develop the connection in a java proxy,
- develop your own adapter,
- buy an adapter for SFTP from a 3rd party,
- if you have UNIX as OS, use OS commands (through shell script in a file adapter for example) to start SSH/SFTP connection.
Regards,
Henrique.

Issue with permissions when using SFTP (FTP over SSH)

I have an issue when i use SFTP, for some reason users are able to browse the system's root directory and other user's directories. Also some users don't have access to the FTPRoot alias and some do. If i connect using FTP everything is fine. Can someone shed some light on this issue.
Thanks,
Toros

There is absolutely no correlation between FTP and SFTP.
SFTP is actually a file transfer run over SSH and therefore subject to the normal account/shell restrictions, just as if the user logged in via SSH.
What you're confusing it with (easily done) is FTPS, which is SSL-encrypted FTP. This uses SSL/TLS to secure a FTP connection and is subject to the account restrictions defined in the FTP server, independent of the user's shell access.
So, in other words, SFTP uses a SSH session to transfer files. FTPS uses SSL to secure a FTP session.
There's no trivial way to prevent a SFTP user from walking through the directory tree since there's no difference between their SFTP session and an SSH session.

[SOLVED]running xwindows session over ssh

hi guys,
i'm trying to run an entire xwindows session - the complete openbox-session - over ssh.
i'm having some joy, in that i can run graphical programs such as gedit, or pcmanfm, luakit or whatever else on the client end no problems. is it possible to run an entire desktop over ssh?
here's some configs and commands i'm running. i'm going by the arch wiki here.
sshd_config:
# $OpenBSD: sshd_config,v 1.90 2013/05/16 04:09:14 dtucker Exp $
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
# The default requires explicit activation of protocol 1
#Protocol 2
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 1024
# Ciphers and keying
#RekeyLimit default none
# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO
# Authentication:
#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
#RSAAuthentication yes
#PubkeyAuthentication yes
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys
#AuthorizedPrincipalsFile none
#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes
PermitEmptyPasswords no
# Change to no to disable s/key passwords
ChallengeResponseAuthentication no
# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
#AllowAgentForwarding yes
AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
X11DisplayOffset 10
X11UseLocalhost yes
PrintMotd no # pam does that
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
UsePrivilegeSeparation sandbox # Default for new installations.
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS yes
#PidFile /run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none
# no default banner path
#Banner none
# override default of no subsystems
Subsystem sftp /usr/lib/ssh/sftp-server
AllowUsers hulk
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# ForceCommand cvs server
ssh_config
# $OpenBSD: ssh_config,v 1.27 2013/05/16 02:00:34 dtucker Exp $
# This is the ssh client system-wide configuration file. See
# ssh_config(5) for more information. This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.
# Configuration data is parsed as follows:
# 1. command line options
# 2. user-specific file
# 3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.
# Site-wide defaults for some commonly used options. For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.
# Host *
# ForwardAgent no
ForwardX11 yes
# RhostsRSAAuthentication no
# RSAAuthentication yes
# PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication no
# GSSAPIDelegateCredentials no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# Port 22
# Protocol 2,1
# Cipher 3des
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160
# EscapeChar ~
# Tunnel no
# TunnelDevice any:any
# PermitLocalCommand no
# VisualHostKey no
# ProxyCommand ssh -q -W %h:%p gateway.example.com
# RekeyLimit 1G 1h
ServerAliveInterval 120
and the command i'm using to ssh in
ssh -X -p 22 user@hostip
i can log in fine every time, but when i do
startx
the openbox session starts on the remote machine, when obviously i want to view it on the client. i should also add i'm using urxvt to ssh in. also, please be aware this is a very basic setup as i'm just starting with ssh.
thanks
Last edited by yabasta (2013-11-06 16:44:37)

yabasta wrote:i'm trying to run an entire xwindows session - the complete openbox-session - over ssh.
If this is the case, why not use a tool that was designed specifically for this purpose? You could set up vnc and then forward the ports to run over ssh. But I have been playing with x2go, which is a open-source NoMachine alternative. It is super easy to set up and runs over ssh. What is really cool is that it actually runs far better than plain ol' vnc with a super responsive desktop.
I don't really have much practical use for it, but after playing with vnc a bit and seeing the shitty performance that it can sometimes have, I heard about NoMachine and decided to give it a whirl. I think the best part is that because it runs over ssh, it is as secure as your sshd setup is. So if you want to open it up to face the greater internet, as long as you feel confident in doing that with ssh, there is no additional ports you need to open up or anything.

Using FTPAdapter over SSH

Dear all
I would like to use the FTPAdapter to send a file across to another server over FTPS (FTP over SSH).
I would be grateful is you could give me a hint or provide me with documentation.
Thanks in advance

Hi,
please search this forum:
Does BPEL FTP Adapter support secure FTP with SFTP utilizing SSH2 protocol?
or
the SOA Suite forum:
Help with ESB - FTP Inbound Adaptor - using SFTP

SFTP and SSH question.

Currently I have a headless OS X Client running Crush FTP over SSH (SFTP) for our work SFTP server this is separate from our main OS X G5 server box.
I can't seem to SSH into the SFTP server via the terminal in order to manage it an poke around like I do with our server.
I am about to setup a little OS X server at home and want SFTP access from it, as I can't justify a seperate box, but I also want to be able to SSH into the box from the outside world too.
I am firstly wondering what the issue is with my Crush FTP server as to wether I will experience the same problem at home.
The 2nd question is can OS X run FTP over SSH (SFTP) with the built in server admin tools and if so is it as easy as Crush FTP to manage?
I will be using ACL's so I guess I could restrict access down that way.
Thoughts, comments, suggestions and explanations very much welcome as I can't find much to answer the above.

Hi: Port 115 is generally used for SimpleFTP. SecureFTP or FTPS uses port 989 and 990. This might help.
Tony

Ctrl+Shift+Option+5 registers as Option+5 in custom emacs build or over ssh

I'm having trouble with custom emacs and emacs over ssh with Leopard. Included below is the text of the bug report I filed with Apple. If anyone has any thoughts or suggestions, I'd love to hear about them.
It won't let me change the OS on this post for some reason, but I'm running Leopard, not Tiger.
In Terminal.app Version 2.0 (237) when I ssh into my Gentoo Linux server and run emacs, or if I run a custom-compiled version of emacs in terminal mode locally, pressing CtrlShift+Option5 (which should bring up "Query replace regexp:" in the bottom input bar) registers as if only Option+5 was pressed.
NOTE: I am using the new aluminum USB-2.0 apple keyboard connected to a MacBook Pro running Leopard 9A581. I have not tested any other hardware configurations.
Steps to reproduce:
1. Download http://ftp.gnu.org/pub/gnu/emacs/emacs-22.1.tar.gz
2. Untar the above
3. cd emacs/mac && ./make-package --self-contained
4. Copy or move Emacs.app to /Applications
5. From Terminal.app run "/Applications/Emacs.app/Contents/MacOS/Emacs -nw"
6. Press CtrlShift+Option5
OR
1. SSH into a linux server and run emacs.
2. Press CtrlShift+Option5
Expected Results:
"Query replace regexp:" should appear in the input line at the bottom of the screen.
Actual Results:
"ESC 5-" shows up. The escape key is an alternate meta-key, so this indicates that the program believes Meta+5 was pushed, where the actual meta-key that I'm using is Option.
I never noticed this problem in any version of Tiger, but it occurs in Leopard.

Perhaps, you should try to reset your preference file to see if it corrects itself. I have posted the instructions at this link:
http://forums.adobe.com/thread/1097046?tstart=0
Good luck.

NSS326 SFTP and SSH Key

Hi,
anyone have idea how to configure SFTP with SSH public/private key (without promt password) for non admin accounts on NAS NSS326 ?
I have tried to generate with Putty and Puttygen a key but works only for admin user. Pls help me.
Thanks
Rudi

Nodoby has a idea about this problem?
Thanks
Rudi

X forwarding suddenly failing over ssh

Hi,
I have an Ultra 20 running solaris 10, and recently started using the patch manager thingy to update my machine automatically. Well, one of those patches botched X11 forwarding over ssh, with the following error message delivered to the client:
==================
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
connect /tmp/.X11-unix/X0: Not a directory
X connection to localhost:10.0 broken (explicit kill or server shutdown).
==================
Looking at this file, i see this:
==================
pwd/tmp/.X11-unix
ls -FCltotal 0
srwxrwxrwx 1 root root 0 Oct 12 19:31 X0=
==================
Which looks more or less correct for a socket. (doing just a plain "ls" returns "X0", and not "X0=").
When run in debug mode, sshd gives this:
==================
debug1: X11 connection requested.
debug1: channel 3: new [X11 connection from ::1 port 33274]
channel 3: open failed: administratively prohibited: open failed
debug1: channel 3: free: X11 connection from ::1 port 33274, nchannels 4
==================
This was working perfectly for a long time, and I don't even know which patch it was that caused the problem.
Help! I can't stand developing with VI any more! Must run xemacs...
Thanks,
Ben

Hello.
With my old computer I managed to display this screen on a Windows X client using XDM. On my new machine I did not manage this because dtgreet does not work on remote machines when having installed the latest patches.
Using SSH it is not possible to show this screen at all.
If it was possible with another version of dtgreet you had to log-in as "root" using SSH (it would not work with another user) which is a problem because SSH typically denies root access.
The question is: Why do you wish to show this display on the remote machine? Maybe there is a better way to archieve the goal you actually want.
Martin

ADT hangs over ssh

I am putting the finishing touches on our build system and have run into a show stopper bug in ADT. It seems that ADT will not function propertly over ssh. When I issue my ADT package command remotely on my Mac OS X machine via ssh, ADT simply hangs forever.
The following are the errors I see on the Mac System Log:
com.apple.SecurityServer: Session 24524 created
naip: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
naip: _RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL.
And then nothing happens. Forever.
Looking on the remote system, I see that the ADT process has created 2 files and a directory in the output directory:
drwxr-xr-x 2 build staff 68 Jun 8 13:10 adt3612439737122910737.tmp
-rw-r--r-- 1 build staff 11553 Jun 8 13:10 air6133709946041732094.tmp
-rw-r--r-- 1 build staff 11553 Jun 8 13:10 air8135951800351503639.tmp
However, nothing else happens. The directory adt3612439737122910737.tmp is empty.
The ADT package command I am running is:
adt -package -storetype pkcs12 -keystore ../build/input/air/cert.p12 -storepass mypassword -tsa none -target bundle ../build/output/tmp/StoicAssetCompiler.mac.app ../build/output/tmp/EngineCompiler-app.xml -C ../build/output/app app.engine.compiler.swf
The command works perfectly when I execute it from a terminal session as the build user. However, any ssh session causes the adt program to hang forever.
Short version: How do I invoke ADT over ssh on Mac OS X?

Additional point of information:
There are 2 users involved here:
john
build
john is logged into a desktop session. john can run ADT from a terminal, or even from a terminal ssh-d back to localhost as john.
build can run ADT from a terminal su'd to build. build cannot run ADT in any ssh session, including one ssh'd from the su'd terminal that works otherwise.

Qt applications over ssh tunnel: very slow redrawing

Regularly I do not use many Qt applications, mostly Skype. I run it over ssh tunnel from another computer within the same local network for long time. After recent system update I noticed it became very slow refreshing its graphics. I checked several Gtk and Qt applications and found that Gtk ones work almost with the "native" speed, while Qt ones with that damn slow redrawing...
I tried ssh with both "ForwardX11" and "ForwardX11Trusted" - there is no difference. I'm using no DE with xmonad WM (tried TWM - no difference either) in x86_64 box.
Any directions/advices/ideas?
Thanks!

Regularly I do not use many Qt applications, mostly Skype. I run it over ssh tunnel from another computer within the same local network for long time. After recent system update I noticed it became very slow refreshing its graphics. I checked several Gtk and Qt applications and found that Gtk ones work almost with the "native" speed, while Qt ones with that damn slow redrawing...
I tried ssh with both "ForwardX11" and "ForwardX11Trusted" - there is no difference. I'm using no DE with xmonad WM (tried TWM - no difference either) in x86_64 box.
Any directions/advices/ideas?
Thanks!

[Solved] Remotely closing X apps over ssh

I'm trying to figure out a way to remotely close an application (like firefox) cleanly over ssh. I know I could run "kill [pid]" or "killall firefox-bin" to close it, but the default termination signal causes firefox to close immediately and give a message at its next start complaining about the program not being shut down properly. I tried several other signals, all of which had the same problem.
Is there a signal that I can issue from kill that will be equivalent to closing the application by clicking the X, pressing Alt-F4, going to File > Quit, etc? If not, is there some other command I can issue to accomplish the same goal?
Last edited by liquidsunshine (2009-03-30 21:56:43)

@Bralkein:
i like the one liner, i've incorporated it into my script. i split it up only because i wanted more meaningful errors.
@liquidsunshine:
thanks for asking this question, this turned out a nifty script. i use pkill all the time, now i have wkill to gracefully close programs from CLI and it works from SSH just as well as locally.
here's the finished product:
#!/bin/bash
# wKill
# pbrisbin 2009
# gracefully close a program's window from
# a remote ssh session, or not
# requires wmctrl
# example usage: wkill firefox
# always exit cleanly
errorout() {
if [ $R -eq 1 ]; then
export DISPLAY=""
fi
echo "$1"
exit $2
# set DISPLAY to your remote X session if we're ssh'd
# though: maybe a "local DISPLAY=" would work?
# it'd be cleaner if it did
if [ -z "$DISPLAY" ]; then
export DISPLAY=":0.0"
R=1
else
R=0
fi
# get the PID by process name
PID=$(pgrep "$1") || errorout "no process by the name: $1" 1
# get the hex by pid
APP=$(wmctrl -pl | grep "$PID" | awk '{print $1}')
# some things don't get reported correctly
if [ -z "$APP" ]; then
APP=$(wmctrl -l | grep "$1" | awk '{print $1}')
if [ -z "$APP" ]; then
errorout "wmctrl can't find pid: $PID or app: $1" 1
fi
fi
# close the apps window
wmctrl -i -c $APP || errorout "wmctrl could not close app: $APP" 1
# put the DISPLAY back to prevent any problems
# do this only if we set it above
if [ $R -eq 1 ]; then
export DISPLAY=""
fi
exit 0
as Bralkein said, some windows might not get reported correctly. i added a nested if in there for two reasons:
a) anything running in a terminal (irssi, mutt, htop) will only be captured by this if they were started with the terminal. something like `xterm -e mutt`. if you opened xterm, then opened mutt. it will be listed as "bash ~" or something in wmctrl and the pid would be of mutt and not xterm... so we're kinda SOL there
b) b/c i'd rather get a nice "could not find pid: X for app: Y" instead of a grep or wmctrl error message (which is what you'd get if the $APP variable is empty)
other than the CLI app issue, it should pretty much catch every exception and run quite cleanly. now if only i knew a real programming language...
Last edited by brisbin33 (2009-03-31 00:26:49)

Running awesome WM over SSH?

I run awesome on my MacBook Air, when I'm at home, I tend to hook my system up to an external monitor, keyboard & mouse. I have another monitor that I would also like to implement in my setup.
My current idea is to get Arch installed on one of my Raspberry Pi's and use it as a sort of thin client, so to speak. So, I'd have the Pi connected to the other monitor, have my MacBook serving up an X session over to the Pi via the network (presumably over SSH) and the Pi displaying that on the screen, which would all seamlessly be controlled with Synergy.
I know that X forwarding is possible, however, I'd like to know if I can serve up an actual awesome session, so my Pi essentially wouldn't actually be running awesome.
Is this achievable? If so, how might I go about implementing it? I've done searches, however they seem to just assume that the client has some sort of graphical environment running already and then to just pull application windows over X, whereas I want to use it as a full desktop.
Many thanks in advance for any advice on this, it'd be greatly appreciated

Hmmm, okay, I have some queries!
I use SLiM as my display manager on my MacBook, so will this even be possible?
Ideally, I'd like to have it setup so I can simply power on my Pi, then have it boot up and initiate the X connection to my MacBook and present an awesome session on the monitor. Are there any means by which this can be achieved?
There's also the factor that I wish to log in as the standard user account that I use, so I'd already be logged in on my MacBook, then have the Pi initiate a connection also through that account... is that even possible? Perhaps I'm thinking this is like SSH
Again, many thanks in advance for any help on this!
**EDIT**
Would it perhaps be possible/better to simply have the Pi set to autologin to a local user (on the Pi) then have it autostart a minimal X session through .bash_profile, and have something like:
ssh -X -C user@MacBook
In the .xinitrc?
(Of course setup with keypairs so the login is automated)
And then I'd have to figure out a means of autorunning awesome & synergyc once it's logged in...
This is just brainstorming of course, but it might work better?
Last edited by Starfall (2012-08-23 11:16:04)

[vim] has('x11') has('clipboard') over ssh, pb copy/cut in vim

Hello
I experiment some problem with vim on my server.
On my laptop and my server I have vim 7.2.266-1
:echo has('x11') && has('clipboard')
It return 1 on my laptop (x86_64) (gnome-terminal) but on the server (i686) (over ssh with gnome-terminal) it return 0.
:-S
I don't understand ...
I would like to know what cause this behaviour and maybe how to enable x11 and clipboard in vim on my server...
Could you help me please

X11 and clipboard are run locally. I do not know of a nice way to do what you want. I agree, reaching for the mouse when selecting/paste text is cumbersome.

SFTP over SSH

Similar Messages

Maybe you are looking for