Setting up SFTP with chrooted users and some other things you can do on a dedicated Linux server

In my post Some tips on downloading and uploading DCPs and large files I wrote about using Filemail, IBM Aspera and Amazon s3 and a dedicated sftp server

Here is some tips when setting up SFTP on a dedicated server running Ubuntu 20.04 or 20.10. A hetzner auction server starts at 30 euro a month. A Raspberry Pi 4/400 cost around 100 euro and can be used as SFTP server.

Start the OpenSSH server


The OpenSSH server is already running on Ubuntu server, but if you are using Ubuntu Desktop you can install and start the Openssh server

sudo apt update
sudo apt install openssh-server
sudo systemctl status ssh

Recommended SSH client

On mac I use terminal. On Windows I use Ubuntu on WSL. To connect to the server.

ssh root@1.1.1.1

Recommended SFTP client

Cyberduck is a fast SFTP client for Windows and Mac because it uses segmented downloads by default.

Setting up basic security

Generating good passwords

sudo apt install pwgen

Generate a 12 digit password

pwgen 12 1

Firewall

Use nftables firewall to accept only port 22 SSH/SFTP. If Nftables is not installed you can install it and start it with these commands.

sudo apt update
sudo apt install nftables
sudo systemctl enable nftables
sudo systemctl start nftables
sudo systemctl status nftables

Edit nftables.conf with modified Simple ruleset for a server to only accept SSH/SFTP

sudo nano /etc/nftables.conf
#!/usr/sbin/nft -f

flush ruleset

table inet firewall {

    chain inbound {

        # By default, drop all traffic unless it meets a filter
        # criteria specified by the rules that follow below.
        type filter hook input priority 0; policy drop;

        # Allow traffic from established and related packets.
        ct state established,related accept

        # Drop invalid packets.
        ct state invalid drop

        # Allow loopback traffic.
        iifname lo accept

        # Allow all ICMP and IGMP traffic, but enforce a rate limit
        # to help prevent some types of flood attacks.
        ip protocol icmp limit rate 4/second accept
        ip6 nexthdr ipv6-icmp limit rate 4/second accept
        ip protocol igmp limit rate 4/second accept

        # Allow SSH on port 22.
        tcp dport 22 accept

        # Allow HTTP(S).
        # -- From anywhere
        #tcp dport { http, https } accept
        #udp dport { http, https } accept
        # -- From approved IP ranges only
        # tcp dport { http, https } ip saddr $SAFE_TRAFFIC_IPS accept
        # udp dport { http, https } ip saddr $SAFE_TRAFFIC_IPS accept

        # Uncomment to allow incoming traffic on other ports.
        # -- Allow Jekyll dev traffic on port 4000.
        # tcp dport 4000 accept

        # Uncomment to enable logging of denied inbound traffic
        # log prefix "[nftables] Inbound Denied: " flags all counter drop

    }

    chain forward {

        # Drop everything (assumes this device is not a router)
        type filter hook forward priority 0; policy drop;

        # Uncomment to enable logging of denied forwards
        # log prefix "[nftables] Forward Denied: " flags all counter drop

    }

    chain outbound {

        # Allow all outbound traffic
        type filter hook output priority 0; policy accept;

    }

}

List the NFT ruleset

sudo nft list ruleset

Stop brute force attacks with sshguard and nftables

Install nftables if necessary

To set up sshguard I used the instruction from here

sudo apt install sshguard

Add sshg-fw-nft-sets to BACKEND= in sshguard-conf if needed

sudo nano /etc/sshguard/sshguard.conf
BACKEND="/usr/lib/x86_64-linux-gnu/sshg-fw-nft-sets"

on Raspberry Pi

BACKEND="/usr/lib/aarch64-linux-gnu/sshg-fw-nft-sets

Start sshguard

sudo systemctl enable sshguard
sudo systemctl restart sshguard
sudo systemctl status sshguard

Soon you will see blocked IP addresses when you list the NFT ruleset

sudo nft list ruleset

Make chroot jail sftp users that can download and upload only from a folder in their home directory

To enable SFTP with chrooted users you need to manually edit sshd_config with the correct settings that disables shell login and then manually add chrooted users.
Link: How to use SFTP with a chroot jail

Change these settings in /etc/ssh/sshd_config

nano /etc/ssh/sshd_config

Put a comment # before this line

/usr/lib/openssh/sftp-server

#Subsystem      sftp    #/usr/lib/openssh/sftp-server

Add this line

Subsystem sftp internal-sftp

add the group sftpusers

Match Group sftpusers
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no

Make a download user called user1 that can download and upload to only /home/user1/data

sudo useradd -g sftpusers -s /sbin/nologin -m -d /home/user1 user1
sudo passwd user1
sudo chown root:root /home/user1
sudo chmod 755 /home/user1/
sudo mkdir /home/user1/data
sudo chown user1:sftpusers /home/user1/data
sudo chmod 755 /home/user1/data
sudo systemctl restart sshd.service

You can also use shell scripts like these made by Matthieu Petiteau on github to do this faster.


Updating the server regularly

It is important to update the server regularly if you are running an unmanaged server.

sudo apt update
sudo apt upgrade

More info: here

Make a user with sudo privileges instead of using root

When Ubuntu is installed you have root access and can log on to the server in a SSH shell with the root account. For better security make a user with sudo privileges that is used instead of root.

sudo adduser newuser

usermod -aG sudo newuser

Source: How To Add User To Sudoers & Add User To Sudo Group On Ubuntu

Disable PermitRootLogin yes from /etc/ssh/sshd_config

When you have a sudoer user you can disable ssh root login. Comment PermitRootLogin yes in sshd_config to disable root access.

sudo apt install nano
sudo nano /etc/ssh/sshd_config
#PermitRootLogin yes


Restart the sshd service
sudo systemctl restart sshd.service 

Backup or copy data to another linux server with rsync over ssh

More info on the commands here. Sync a directory and subdirectories to another server.

rsync -aP /home/user/data/ download1@1.1.1.1:/home/download1/data

Other things you can do on a linux server

Logging on to the server with SSH and downloading a DCP folder or videofiles from another SFTP/FTP server

Sometimes it can be nice to download something directly from ftp servers and filemail via ftp to the server. In terminal you can use SSH to login to the server and use the command screen to detach from the session so you can resume it if the connection to the server is broken.

ssh user@111.111.111.111


If I want to download something to a folder /home/user/download/newfolderwiththings.

cd /home/user/download
mkdir newfolderwiththings
sudo apt update
sudo apt install ncftp
sudo apt install screen
screen
ncftp -u username 111.111.111.111

When you have started ncftp you can use get with the recursive command -R to download a folder and subdirectories. And use ls to list the content and cd to change directories,

ls
cd folder
get -R /folderwithhings

detach from the screen by using control + a,d

when connecting to the ssh server again use screen -r to attach to the session again.

screen -r 

If you have started many screen sessions you will get a list of sessions so you can choose which to start. To exit a screen session you can use

exit

Compress and uncompress files on the server

You can make a 7z compressed archive of files on the server so it would be faster to download them. You can also upload an archive and then uncompress it on the server. You can also split the archive in parts so you can download many parts at once. You can use screen to be able to log of the ssh session while the files are being compressed.

Install 7z

sudo apt update
sudo apt install p7zip p7zip-rar p7zip-full 

Compress a folder and it’s subdirectories

7z a -r directory.7z /directory

Compress a file

7z a archive.7z file.wav

Compress a directory and sub directories. Normal compression. Useful for wav files and similar files that will compress to half the size. Split in 3 GB parts. Cyberduck default setting is to use segmented download, but it can speed up uploads and downloads to split files in parts.

7z a -r -v3000m directory.7z  /directory

Compress file. Using -mx0 for no compression. Split in 3 GB parts . Useful if you want to make the archive faster and for files that don’t compress much like prores video files.

7z a -mx0 -v3000m archive.7z  prores.mov

You can also upload 7z archive files and extract them on the server.
Extract archive recursively and keep the subdirectories

7z x archive.7z

Making a MD5 checksum file of files in a directory.

.You can check the MD5 checksum of a file on the server with the command

md5sum file

To be able to test the integrity of folder with files you can have md5 text checksum files. You can make a checksum.md5 file with the md5 checksum of files in a directory like this

md5sum * > checksums.md5

To check the checksum of the files in a directory with the md5 checksum file you can use .

md5sum -c checksums.md5

Mount a remote directory with sshfs and fuse.


Sometimes it can be handy to change the name of a DCP that had already been uploaded. Or do other things with files on the server as if they were on your local computer . With sshfs and fuse you can mount a folder on the server as a local folder and open it in Easydcp Creator and change the name or other metadata like the content kind or the offset on reels. Easydcp Creator saves the new metadata to the folder on the server.
To mount the folder from the server locally on my mac I use the commands from here

Install Homebrew

Install osxfuse and sshfs in the terminal with these commands

brew cask install osxfuse
brew install sshfs

Reboot.
Make a local directory that the folder will be mounted in. In Terminal I made a directory called server on the desktop.

cd Desktop
mkdir server



To mount the folder on the server you use the sshfs command (link man sshfs)

sshfs [user@]host:[dir] mountpoint [options]

This is how you mount the home folder of the user yourname

sshfs yourname@111.111.111.111:/home/yourname /Users/yourname/Desktop/server

To open the DCP in the Easydcp Creator I drag the folder to the Easydcp window and wait a little bit. You can also open a Resolve or Premiere project this way.


To unmount you can use the umount command

sudo umount /Users/yourname/Desktop/server


Converting a video file or sound file on the server with ffmpeg


Converting a high-quality video file to a low-res version on the server so it can be downloaded easier. Example: You need a file to check subtitles. Or a small file to upload as a screener.
If you need a small size h264 video file of a file on the server you can use ffmpeg to convert it.

sudo apt update
sudo apt install ffmpeg 
ffmpeg -i bigfile.mov smallfile.mp4
ffmpeg -i bigfile.wav smallfile.aac

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.