For Unix, Linux, and OS X systems, SFTPPlus is distributed as a gzipped TAR archive. Installing SFTPPlus on these operating systems consists of unpacking the archive, initializing the configuration and generating the SSH keys and the SSL certificate which will be used by the product.
The included default configuration requires the creation of a system account, named sftpplus, under which the SFTPPlus process is executed. Optionally, you may choose to run SFTPPlus as root, especially if you want it to authenticate operating system users.
In order to have SFTPPlus started at boot time, you may also use the included init script, unit file or plist. For Unix and Linux, the service initialization script has been tested on all supported operating systems, but it should work on other systems as well.
After downloading the compressed archive, you can extract the files using the following command:
gunzip -dc sftpplus-os-arch-version.tar.gz | tar -xf -
Note
The tar archive has been created using pax, and should be extractable by the GNU tar command or its alternatives.
To install SFTPPlus, move (or copy/link) the unpacked directory to your preferred installation path, for example: /opt/sftpplus or, if you are using OS X, /Library/sftpplus.
Note
SFTPPlus may be installed in any location on the local file system. For the purposes of this documentation, we will assume that on Unix and Linux systems, SFTPPlus is unpacked in the /opt/sftpplus directory (we will discuss the INSTALL_ROOT more later).
Note
For OS X we will assume that SFTPPlus is unpacked in the /Library/sftpplus directory. In the following examples please replace /opt/sftpplus/ with /Library/sftpplus.
When installing SFTPPlus on a machine for the first time, you need to generate the initial configuration file and a machine-specific SSH key. A self-signed SSL certificate will also be generated to help with the initial FTPS testing.
To initialize SFTPPlus, execute the following commands:
cd /opt/sftpplus
./bin/admin-commands.sh initialize
Warning
The initialization step is not required when upgrading SFTPPlus. It will not overwrite the configuration file, SSH keys, and SSL certificate, if existing. In the case that you want to generate a new configuration, manually remove the existing files.
Warning
To prevent creating huge log files, the default configuration creates a log file which is automatically rotated at the end of the day. Please take the time to alter the log file configuration option to suit your needs.
On Unix and Linux systems, SFTPPlus’ process runs as a single, self managed daemon. It does not depend on inetd (the Internet daemon).
On OS X systems, SFTPPlus’ process is managed by launchd.
On Linux/Unix the SFTPPlus is designed to run as a foreground process executed under the root account and will drop privileges after it is launched.
For local accounts, defined in the operating system, the file system access will be granted according to user permissions for the local file system.
For application accounts, all file system activity will be executed under the account specified by the [server] account configuration option. Application accounts are locked into their home directories. The [server] account configuration option is described in the next section.
Creating a new group and a new user, dedicated to running SFTPPlus’ process, is recommended.
On Unix and Linux systems, SFTPPlus is able to drop privileges to a regular account. The default configuration takes advantage of this feature, thus requiring a dedicated sftpplus operating system account to be created. Please note that in such a configuration SFTPPlus will only be able to authenticate application accounts.
To enable authentication for accounts defined in the operating system, please start SFTPPlus as root after disabling account switching. This can be done by changing the following option in the server.ini configuration file, as below:
[server]
account = Disabled
Effectively, this means that the product will continue running with root privileges after start.
Note
Starting as root is required when SFTPPlus’ services are binding to TCP/UDP ports below 1024, for example 21 or 22.
In the following example we will use the default configuration value of sftpplus for the name of the user to run SFTPPlus.
To create an sftpplus group and user in Linux and Solaris:
groupadd sftpplus
useradd -g sftpplus -c "SFTPPlus" -s /bin/false \
-d /dev/null sftpplus
To create an sftpplus group and user in HP-UX (where useradd doesn’t allow creating accounts with a /dev/null home):
groupadd sftpplus
useradd -g sftpplus -c "SFTPPlus" -s /bin/false \
-d /var/empty/ sftpplus
To create an sftpplus group and user in AIX:
mkgroup sftpplus
mkuser sftpplus
usermod -g sftpplus -d /dev/null -s /bin/false -c "SFTPPlus" \
sftpplus
Note
On AIX you’ll need to add /bin/false to the list of valid login shells in /etc/security/login.cfg before changing the shell of the sftpplus user with usermod.
To create an sftpplus group and a corresponding user on OS X, replace the value of 240 from the following example with a unique ID for your system:
# Create the group dedicated to the service account.
dscl . create /Groups/sftpplus
# Assign an unique ID to the group.
dscl . create /Groups/sftpplus PrimaryGroupID 240
# Disable group password.
dscl . create /Groups/sftpplus Password '*'
# Create a user for the service account.
dscl . create /Users/sftpplus
# Assign a unique ID to the new user.
dscl . create /Users/sftpplus UniqueID 240
# Assign this account to the dedicated group.
dscl . create /Users/sftpplus PrimaryGroupID 240
# Disable shell access.
dscl . create /Users/sftpplus UserShell /usr/bin/false
# Make sure it has a default empty home folder.
dscl . create /Users/sftpplus NFSHomeDirectory /var/empty
# Disable password to block any authentication request.
dscl . create /Users/sftpplus Password '*'
# Initialize blank password and authentication rules.
dscl . delete /Users/sftpplus PasswordPolicyOption
dscl . delete /Users/sftpplus AuthenticationAuthority
Tip
On OS X you can use the dscacheutil -q user and dscacheutil -q group tools to identify the used IDs and pick a unique ID for the system.
Tip
The above commands are included into an easy to use script which is available as osx_useradd.sh
To configure SFTPPlus to run under the newly created account, make sure the following option is present in the server.ini configuration file:
[server]
account = sftpplus
Attention
Don’t forget to adjust the ownership of the files, otherwise some of the functionality (most notably logging) will not work.
For example use: chown -R sftpplus:sftpplus /opt/sftpplus/
For Unix and Linux systems, the following script is provided as a starting point for creating custom initialization scripts for various service managers (SysVinit, Upstart, systemd with SysV compatibility, etc.):
bin/sftpplus-mft.sysv.sh
You should copy the sample script to the standard location used by the initialization system of your operating system:
Make sure the script is executable, and amend the INSTALL_ROOT variable found inside the script to the installation path of your SFTPPlus instance. In the case that SFTPPlus is installed at /opt/sftpplus, the script’s relevant section should look as follows:
# Replace INSTALL_ROOT with your installation path.
INSTALL_ROOT="/opt/sftpplus"
On systemd-based distributions (especially on those without the SysV compatibility bits, such as Arch Linux) you can use the following unit file:
bin/sftpplus-mft.service
Note
You should copy it to /etc/systemd/system, customizing the ExecStart and WorkingDirectory paths based on your SFTPPlus installation.
Depending on your operating system, you will have to either manually create symbolic links to the initialization script from the rcN.d directories (where N is the runlevel) or run a specific tool that will automatically do that.
Examples (as root):
- on Ubuntu: update-rc.d sftpplus-mft defaults
- on RHEL and SUSE: chkconfig –add sftpplus-mft
- on Linux systems with systemd: systemctl enable sftpplus-mft
- on Solaris: ln -s /etc/init.d/sftpplus-mft /etc/rc3.d/S99sftpplus-mft
- on AIX: ln -s /etc/rc.d/init.d/sftpplus-mft /etc/rc.d/rc2.d/S99sftpplus-mft
- on HP-UX: ln -s /sbin/init.d/sftpplus-mft /sbin/rc3.d/S999sftpplus-mft
Note
On Solaris the above command will configure the service using the legacy init scripting start-up mechanism common to prior releases of Solaris and other UNIX operating systems. Please contact us in the case that you need integration with the Service Management Facility (SMF).
On Linux systems, in order to start / stop / restart SFTPPlus, or to check its status, you can either call the script directly as:
/etc/init.d/sftpplus-mft COMMAND
or through the relevant service management tool provided by the operating system:
service sftpplus-mft COMMAND
systemctl COMMAND sftpplus-mft
where COMMAND can be one of the following:
- start
- stop
- restart
- force-reload
- force-stop (only for the SysV init script)
- status
Note
The ‘force-reload’ action is an alias for ‘restart’ in order to comply with the Linux Standard Base.
On non-Linux systems (AIX, Solaris, HP-UX, etc.) the same commands are supported, but only the option to call the script directly is available.
For Solaris:
/etc/init.d/sftpplus-mft COMMAND
For AIX:
/etc/rc.d/init.d/sftpplus-mft COMMAND
For HP-UX:
/sbin/init.d/sftpplus-mft COMMAND
Note
When running the legacy SFTPPlus WebAdmin on the same machine, SFTPPlus should be started after Apache, as it will check the availability of the configured legacy SFTPPlus WebAdmin.
For Mac OS X systems newer than 10.8, the following launchd job definition is provided together with the SFTPPlus distribution. The job definition file is formatted as XML, and it is called a property list file or plist:
bin/Library_LaunchDaemons_sftpplus.plist
The sample job definition file assumes that SFTPPlus is installed in the /Library/sftpplus directory. Depending on where the job definition is stored, it will be treated as a daemon or an agent. In order to have SFTPPlus act as a global daemon, launching it each time the OS X system starts, you need to copy the plist file into the following location: /Library/LaunchDaemons/sftpplus.plist
After the file is copied, you need to instruct launchd to load/read the new job definition file using the command:
launchctl load /Library/LaunchDaemons/sftpplus.plist
Note
At boot time the launchd process will scan and automatically load job definitions found in the /Library/LaunchDaemons directory.
To stop SFTPPlus, use the following command:
launchctl unload /Library/LaunchDaemons/sftpplus.plist
Attention
In the case that there are problems starting the server, you can check the log files at /var/log/system.log and /var/log/sftpplus-launchd.log.
You can also launch SFTPPlus in debug mode using:
./bin/admin-commands.sh debug
Tip
You can read more about launchd on the official documentation page
Once unpacked, the SFTPPlus installation should have the following hierarchical directory structure on disk.
This list also describes the permissions required for the service account.
The Local Manager is a good way to visualize the current Configuration, and is even configurable itself. You might want to check out the Getting Started guide to get an idea of how best to begin. There is also an FAQ if you have an idea, but are in search of answers. If you want to skip ahead, the Configuration Instructions or the Usage Instructions might be good places to go.