sftp over SSL

[abhipaul]

how i can configure my 2 hp unix servers into SFTP over SSL. pls send me the procedure to do the same..
thanks...

[Matti_Kurkela]

"SFTP" usually means the file transfer extension of the SSH protocol version 2. It's already strongly encrypted, so there is normally no need to add another encryption layer using SSL.

But if you need it for some strange reason, I think it *might* be possible to do it using the "stunnel" utility from the HP-UX Internet Express package. I have never tried it myself.

Here's a generic set of instructions for forwarding any port over SSL. Just substitute "ssh" for "pop3" and choose your own port number instead of using "pop3s", and you're all set:

http://www.stunnel.org/examples/generic_tunnel.html


If you meant "FTP-over-SSL", that is usually identified as FTPS, not SFTP. The standard HP-UX FTP server cannot do it, so you must install another FTP server binary. The free HP-UX Internet Express package includes ProFTPD, which can do FTPS.

The Internet Express for HP-UX 11.11 is no longer available from software.hp.com: if you have a recent HP-UX 11.11 media kit, it should include an Internet Express CD.

The Internet Express for HP-UX 11.23 and 11.31 is available from software.hp.com:

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1123

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1131

Instructions on configuring ProFTPD for SSL/TLS can be found on the ProFTPD homepage:

http://www.proftpd.org/docs/howto/TLS.html


You will also need a FTPS client. The Internet Express package includes cURL, which can do FTPS.

See these threads for more FTPS client options:

http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1273721

http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1030075

MK

[rariasn]

Hi,

Modify generic file "ssd_config"

# cd /etc/opt/ssh
# grep sftp sshd_config
Subsystem sftp /opt/ssh/libexec/sftp-server -f LOCAL1 -l INFO

# /sbin/init.d/secsh stop

# /sbin/init.d/secsh start

# sftp localhost

Connecting to localhost...
sftp>!

#ps -ef|grep -i sftp | grep -v grep
root 14305 14304 0 14:08:29 ? 0:00 /opt/ssh/libexec/sftp-server -f LOCAL1 -l INFO
root 14304 14302 0 14:08:29 ? 0:00 sh -c /opt/ssh/libexec/sftp-server -f LOCAL1 -l INFO
root 14300 9866 0 14:08:28 pts/1 0:00 sftp localhost

rgs,