-
-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
--------- Co-authored-by: Stéphane Gigandet <[email protected]>
- Loading branch information
1 parent
7d8a65c
commit ec3c1be
Showing
6 changed files
with
166 additions
and
330 deletions.
There are no files selected for viewing
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,17 @@ | ||
# Configuration of sftp users | ||
# | ||
# sftp is used by producers or other data providers to submit data to integrate to openfoodfacts | ||
# | ||
|
||
# sftp configuration, for all users of sftponly group | ||
Match Group sftponly | ||
# %u is local user id | ||
# force user to stay in is directory | ||
ChrootDirectory /mnt/off-pro/sftp/%u | ||
# public keys are in sftp directory | ||
AuthorizedKeysFile /mnt/off-pro/sftp/%u_authorized_keys | ||
# some security parameters | ||
X11Forwarding no | ||
AllowTcpForwarding no | ||
# only allow sftp | ||
ForceCommand internal-sftp |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -4,10 +4,32 @@ We have a producer SFTP which is part of the producer platform. | |
|
||
This sftp is used by producers who send files for regular automated updates of their products. | ||
|
||
The sftp is located on off1.openfoodfacts.org | ||
The sftp is located on the reverse proxy container (because it needs it's own network interface). | ||
|
||
The `/home/sftp` folder links to `/srv/sftp/` and contains home for sftp users. | ||
The sftp directory is a ZFS dataset in `zfs-hdd/off-pro/sftp`. | ||
It is mounted as `/mnt/off-pro/sftp`: | ||
* in the reverse proxy to give access to producers themselves (through sftp) | ||
* and in off-pro container to give access to files to the producers platform. | ||
|
||
In the reverse proxy container, the sftp is configured in /etc/ssh/sshd_config.d/sftp.conf which is a symlink to `confs/proxy-off/sshd_config/sftp.conf` in this repository. | ||
|
||
If a producer want's to connect with a key, put the public key in a file named `/mnt/off-pro/sftp/<username>_authorized_keys`. | ||
|
||
## Adding a new sftp user | ||
|
||
Use the script [`add_sftp_user.pl`](../scripts/off1/add_sftp_user.pl) (present in `/home/script`) with user root. | ||
Use the script [`add_sftp_user.pl`](../scripts/off1/add_sftp_user.pl) (present in `script/off-proxy`) with user root in the reverse proxy container. | ||
|
||
**:fire: IMPORTANT :fire::** every user **must be in `sftponly` group** and only in this one. | ||
|
||
You may eventually communicate the server key fingerprint to the producer | ||
(get it with `ssh-keyscan $(hostname) | ssh-keygen -lf -`) | ||
|
||
It's better to test access before sending the mail to the producer: | ||
|
||
```bash | ||
lftp sftp://[email protected] | ||
password: | ||
> ls | ||
``` | ||
|
||
(issue at least an `ls` because `lftp` only try to connect at the first command) |
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.