Configuring SFTP on ProFTPD

Configuring SFTP on ProFTPD

To use SFTP with the ProFTPD FTP server, install and configure the corresponding module.

Connect to the server via SSH as root and install the module if you have Ubuntu 24.04:

apt install proftpd-mod-sftp-ldap

Installation is not required on AlmaLinux 9.

Uncomment or add the LoadModule mod_sftp.c line in the configuration file /etc/proftpd/modules.conf

Next, restart the ProFTPD service and check if the module is enabled:

service proftpd restart
proftpd -vv | grep mod_sftp

The SFTP module requires its own encryption keys. Create a directory for them and generate the keys:

mkdir -p /etc/proftpd/ssh_keys
ssh-keygen -t rsa -b 4096 -f /etc/proftpd/ssh_keys/sftp_host_rsa_key -N "" -m PEM
chown -R root:root /etc/proftpd/ssh_keys
chmod 700 /etc/proftpd/ssh_keys
chmod 600 /etc/proftpd/ssh_keys/*

Create the files of the virtual SFTP users information.

touch /etc/proftpd/sftpd_passwd /etc/proftpd/sftpd_group
chown root:root /etc/proftpd/sftpd_passwd /etc/proftpd/sftpd_group
chmod 640 /etc/proftpd/sftpd_passwd /etc/proftpd/sftpd_group

Create the configuration file and log for the module:

touch /etc/proftpd/conf.d/sftp.conf
touch /var/log/proftpd/sftp.log

Before adding the configuration, select any suitable port on the server and check if it's busy. For example, port 2222:

ss -tulpan | grep 2222

If the port is not in use, the command output will be empty.

Instead of <VirtualHost 0.0.0.0> and2222, in the configuration below, specify your server's IP address and the selected free port on which the service will listen.

Add the following configuration to the created file sftp.conf:

 <IfModule mod_sftp.c>
    <VirtualHost 0.0.0.0>
        Port 2222
        SFTPEngine on
        SFTPLog /var/log/proftpd/sftp.log
        
        SFTPHostKey /etc/proftpd/ssh_keys/sftp_host_rsa_key

        AuthOrder mod_auth_file.c
        AuthUserFile /etc/proftpd/sftpd_passwd
        AuthGroupFile /etc/proftpd/sftpd_group
        
        DefaultRoot ~
        RequireValidShell off
        
        TLSEngine off

        <Directory />
            AllowOverwrite yes
        </Directory>
    </VirtualHost>
</IfModule>

Check the configuration:

proftpd -t

If the syntax is correct, the output will be as follows:

Checking syntax of configuration file
Syntax check complete.

Restart the service:

service proftpd restart

Create SFTP users

Add information about SFTP user to the file /etc/proftpd/sftpd_passwd,using the format

<sftp_username>:<password_hash>:<system_user_uid>:<system_user_gid>::/var/www/<system_username>/data/<sftp_username_home_directory>:/bin/false

To create password hash, use the command

 echo -n "<your_password>" | openssl passwd -1 -stdin

Add information about SFTP user group to the file /etc/proftpd/sftpd_group,using the format

<sytem_username>:x:<system_user_gid>:<sftp_username>

Restart the service:

service proftpd restart

Check the availability of the FTP server on the port specified for SFTP from an external device:

sftp -P <port_number> <sftp_user_name>@<server_ip_address>