Skip to content

Operations

This page covers running OpenSSH SFTP Drop Box day to day: how it is secured, how it is updated, what to back up, where the logs are, and how to get help.

Security model

  • Loopback only. The SFTP service listens on 127.0.0.1:2222 until you add a listen address and open the security group yourself.
  • Separate from host SSH. The SFTP service is its own sshd process with its own configuration and host key. The instance's administrative SSH service is unchanged.
  • Locked-in users. SFTP users are confined to their own folder, can write only in incoming/, sign in only with a public key, and have no shell and no forwarding of any kind.
  • Per-instance keys. The transfer user's key pair and the SFTP host key are created on first boot. The private keys are readable only by root; the ubuntu user cannot read them.
  • SSH. On the host's own SSH service, password authentication and root login are turned off.
  • No AWS access. The service does not call AWS APIs and needs no IAM permissions. If you later add, for example, a sync to S3, attach a role limited to just that. Never put AWS access keys in authorized key files.

Manage the service

sudo systemctl status sushi-sftp
sudo systemctl restart sushi-sftp

sushi-sftp.service waits for sushi-sftp-firstboot.service, checks its configuration before it starts, and restarts automatically if it fails.

First boot runs on every boot but keeps existing keys and users. If only a public key file is missing, it recreates it from the private key. It does not create a new identity over a missing or mismatched private key: it stops so you can restore the original pair.

Logs

sudo journalctl -u sushi-sftp --no-pager -n 100
sudo journalctl -u sushi-sftp-firstboot --no-pager

Updates

OpenSSH and the other Ubuntu packages get security updates automatically through unattended upgrades.

A new version of the AMI does not change running instances. To move to it, launch the new version, restore your backup, then point clients at the new host.

Backups

Back up these together:

  • /var/lib/sushi-sftp/: users' folders and files, the transfer key pair, and the SFTP host key
  • /etc/ssh/sftp-authorized-keys/
  • /opt/sushi/etc/sftp/sshd_config

Restore the SFTP host key, in /var/lib/sushi-sftp/hostkeys/, only if you want clients to see the same server identity. Otherwise they are asked to accept a new host key. Restored private keys must be owned by root:root with mode 0600.

The root volume is the only disk. Practice a restore on a test instance before you depend on it.

Check the installation

The image includes a self-test that runs as root:

sudo /opt/sushi/bin/smoke.sh

It creates a temporary test user and checks uploads, downloads and the restrictions on loopback. Run it on a test instance rather than one in use.

Support

Software Sushi provides AMI packaging and setup guidance. Email info@softwaresushi.com with installation questions. Support coverage beyond that requires a separate agreement. This offer does not include support from the OpenSSH project.