News for hackers. Stuff that matters.
Re:SFTPGo: A Full Featured SFTP Server in Go by jasonjayr on Friday July 26, 2019 @01:25AM (#20532574)
I'd second this, I've longed struggled to come up with a easy-to-deploy sshd/sftp/chroot configuration that permitted easy database-driven configuration w/o extra shell access. You have to fight a lot of defaults to get this just right.

Would the OpenSSH upstream accept patches for an unprivileged sshd/sftp-subsystem to make this easier to use their battle tested code?

Re:SFTPGo: A Full Featured SFTP Server in Go by sandreas on Friday July 26, 2019 @03:25AM (#20533000)
If you just want to share files and not giving the option to upload files, you could try graft...

https://github.com/sandreas/graft

graft serve ./*.txt

will serve every txt file in the current dir...

Re:SFTPGo: A Full Featured SFTP Server in Go by yjftsjthsd-h on Friday July 26, 2019 @08:42AM (#20534307)
For that use case, I just use `python3 -m http.server` (or the Python 2 equivalent), especially since Python is almost always already installed.
Re:SFTPGo: A Full Featured SFTP Server in Go by sandreas on Friday July 26, 2019 @02:44PM (#20537286)
Cool... is SSL support for secure file transfer?
Re:SFTPGo: A Full Featured SFTP Server in Go by concert-gilled on Friday July 26, 2019 @01:13PM (#20536364)
If you don't mind, I have a question about graft.

> graft will prompt for a password, run an sftp server and promote it via zeroconf.

Is that a one time password that will be used by the "receiver" to download the file?

Re:SFTPGo: A Full Featured SFTP Server in Go by sandreas on Friday July 26, 2019 @02:43PM (#20537277)
No, it is a static unchangeable password. Graft can't "manage" user accounts, it just has one user with password. It does not support keyfiles or other authentication mechanisms.

I wrote graft to have a simple portable tool for transfering files in a network without shares - the main idea behind it was to run:

graft serve myfiles/*.txt

on the server side and then

graft receive

on the client side without having to remember the ip or hostname - because zeroconf / mdns is used, it will find the server automatically, if the network is not too big. If there is more than one server, it will prompt you to choose the right one.

I only used SFTP, because it is a secure way to transfer files over the network.

Re:SFTPGo: A Full Featured SFTP Server in Go by Nux on Friday July 26, 2019 @01:54AM (#20532687)
Proftpd can do sftp-only out of the box.
Re:SFTPGo: A Full Featured SFTP Server in Go by pilif on Friday July 26, 2019 @10:37AM (#20535101)
on the other hand, its SQL backend modules insist on fetching a password and comparing them using their own functionality and there's no way to get to the the user's typed password into a custom query.

That means that there's no way to authenticate users if you use a password encryption scheme not supported by the bundled modules (like bcrypt for example)

Re:SFTPGo: A Full Featured SFTP Server in Go by jasonjayr on Friday July 26, 2019 @06:35AM (#20533758)
I am not sure why I didn't realize that sooner, but that's awesome, thank you for pointing that out.