Configuration¶

This page shows where the SFTP service's configuration lives, how to add users, and how to let clients on your network connect.

Where configuration lives¶

Path	What it is
`/opt/sushi/etc/sftp/sshd_config`	The SFTP service's configuration. The host's own SSH configuration is separate and unchanged.
`/etc/ssh/sftp-authorized-keys/<user>`	Each user's authorized public key.
`/var/lib/sushi-sftp/jails/<user>`	Each user's folder. Owned by `root`, mode 0755.
`/var/lib/sushi-sftp/jails/<user>/incoming`	The one folder the user can write to.
`/var/lib/sushi-sftp/customer/`	The `transfer` user's key pair, created on first boot. `root` only.
`/var/lib/sushi-sftp/hostkeys/`	The SFTP service's own host key.

The main settings in sshd_config:

Port 2222 and ListenAddress 127.0.0.1.
AllowGroups sftpusers: only members of sftpusers can sign in.
PasswordAuthentication no and PermitRootLogin no.
For sftpusers: ChrootDirectory /var/lib/sushi-sftp/jails/%u, ForceCommand internal-sftp -d incoming, DisableForwarding yes, and keys from /etc/ssh/sftp-authorized-keys/%u.

Add a user¶

Ask your partner for their public key, an OpenSSH line starting with ssh-ed25519, ssh-rsa or ecdsa-sha2-nistp256. Copy it to the instance, then run the helper with a new user name:

sudo /opt/sushi/bin/sftp-prepare-user.sh vendor /path/to/vendor.pub

The helper:

creates the user in group sftpusers, with no shell,
creates /var/lib/sushi-sftp/jails/vendor and its incoming/ folder,
installs the key as /etc/ssh/sftp-authorized-keys/vendor.

User names are 3 to 32 characters of lowercase letters, digits or hyphens. The helper refuses system accounts and any existing account that is not already a managed SFTP user, and it refuses a file that contains a private key.

The new user can sign in straight away. No restart is needed.

Replace a user's key¶

Run the helper again for the same user with the new public key. It replaces the authorized key and keeps the account and its files.

sudo /opt/sushi/bin/sftp-prepare-user.sh vendor /path/to/new-vendor.pub

Accept connections from your network¶

The service listens on 127.0.0.1 only. To let clients in your VPC connect:

Add a second ListenAddress line with the instance's private address to /opt/sushi/etc/sftp/sshd_config:
```
ListenAddress 127.0.0.1
ListenAddress <private-ip>
```

Check the configuration:

sudo sshd -t -f /opt/sushi/etc/sftp/sshd_config

Restart the SFTP service:
```
sudo systemctl restart sushi-sftp
```
In the security group, allow TCP 2222 only from the client address ranges that need it.

Clients then connect with:

sftp -P 2222 -i <private-key-file> <user>@<private-ip>

Give your partners the host key fingerprint, from sudo ssh-keygen -lf /var/lib/sushi-sftp/hostkeys/ssh_host_ed25519_key.pub, so they can check it on first connection.

Warning

Do not open port 2222 to 0.0.0.0/0, turn on password authentication, or give SFTP users a shell such as /bin/bash.

Keep the folders safe¶

OpenSSH only allows a user's folder as a chroot if every part of its path is owned by root and not writable by anyone else. Keep /var/lib/sushi-sftp/jails/<user> owned by root with mode 0755, and let users write only in incoming/.

Disk space¶

All files are stored on the root volume, and there are no per-user quotas. Size the volume for the largest files you expect, and grow it with EBS if you need more.