Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: new sftp configuration #275

Merged
merged 3 commits into from
Nov 29, 2023
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
240 changes: 0 additions & 240 deletions confs/proxy-off/sshd_config/sftp

This file was deleted.

17 changes: 17 additions & 0 deletions confs/proxy-off/sshd_config/sftp.conf
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# Configuration of sftp users
#
# sftp is used by producers or other data providers to submit data to integrate to openfoodfacts
#

# sftp configuration, for all users of sftponly group
Match Group sftponly
# %u is local use id
alexgarel marked this conversation as resolved.
Show resolved Hide resolved
# force user to stay in is directory
ChrootDirectory /mnt/off-pro/sftp/%u
# public keys are in sftp directory
AuthorizedKeysFile /mnt/off-pro/sftp/%u_authorized_keys
# some security parameters
X11Forwarding no
AllowTcpForwarding no
# only allow sftp
ForceCommand internal-sftp
4 changes: 3 additions & 1 deletion docs/nginx-reverse-proxy.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
# NGINX Reverse proxy (OVH)

At OVH and at Free we have a LXC container dedicated to reverse proxy http/https applications. It serves applications that are located in servers at the same provider (and same Proxmox cluster).
At OVH and at Free we have a LXC container dedicated to reverse proxy http/https applications.

It serves applications that are located in servers at the same provider (and same Proxmox cluster).

## Network specific interface

Expand Down
28 changes: 25 additions & 3 deletions docs/producers_sftp.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,32 @@ We have a producer SFTP which is part of the producer platform.

This sftp is used by producers who send files for regular automated updates of their products.

The sftp is located on off1.openfoodfacts.org
The sftp is located on the reverse proxy container (because it needs it's own network interface).

The `/home/sftp` folder links to `/srv/sftp/` and contains home for sftp users.
The sftp directory is a ZFS dataset in `zfs-hdd/off-pro/sftp`.
It is mounted as `/mnt/off-pro/sftp`:
* in the reverse proxy to give access to producers themselves (through sftp)
* and in off-pro container to give access to files to the producers platform.

In the reverse proxy container, the sftp is configured in /etc/ssh/sshd_config.d/sftp.conf which is a symlink to `confs/proxy-off/sshd_config/sftp.conf` in this repository.

If a producer want's to connect with a key, put the public key in a file named `/mnt/off-pro/sftp/<username>_authorized_keys`.

## Adding a new sftp user

Use the script [`add_sftp_user.pl`](../scripts/off1/add_sftp_user.pl) (present in `/home/script`) with user root.
Use the script [`add_sftp_user.pl`](../scripts/off1/add_sftp_user.pl) (present in `script/off-proxy`) with user root in the reverse proxy container.

**:fire: IMPORTANT :fire::** every user **must be in `sftponly` group** and only in this one.

You may eventually communicate the server key fingerprint to the producer
(get it with `ssh-keyscan $(hostname) | ssh-keygen -lf -`)

It's better to test access before sending the mail to the producer:

```bash
lftp sftp://[email protected]
password:
> ls
```

(issue at least an `ls` because `lftp` only try to connect at the first command)
86 changes: 0 additions & 86 deletions scripts/off1/add_sftp_user.pl

This file was deleted.

Loading
Loading