Setting Up TSFTP on Your Server — Step-by-Step TutorialNote: “TSFTP” is treated here as a hypothetical secure file-transfer protocol modeled on common secure file-transfer implementations (like SFTP/FTPS) with its own server and client components. Replace TSFTP-specific commands and configuration file names with those for your actual implementation if your TSFTP variant differs.
Overview
TSFTP is a secure file-transfer protocol designed to provide encrypted, authenticated file transfers between clients and servers. This tutorial walks through planning, installing, configuring, securing, testing, and troubleshooting a TSFTP server on a Linux host (examples use Debian/Ubuntu and CentOS/RHEL variants). It covers user accounts, key-based authentication, firewall rules, chroot/jail setups, logging, and automation.
Prerequisites
- A Linux server (Ubuntu 22.04 / Debian 12 / CentOS 8+ or similar) with root or sudo access.
- Basic command-line familiarity.
- TSFTP server package (binary or source) and TSFTP client. If TSFTP is provided as a package, install using your distro package manager; otherwise follow the vendor’s install instructions.
- A non-root system account to administer the TSFTP service.
- Optional: TLS certificate if TSFTP supports TLS-based transport.
Step 1 — Planning your TSFTP deployment
- Define purpose and scope: internal backups, public downloads, or partner transfers.
- Choose authentication methods: password, public-key (recommended), or client TLS certificates.
- Decide on chroot/jail for users to restrict filesystem access.
- Select storage: local disk, mounted network storage (NFS/SMB), or cloud storage. Ensure permissions and concurrency are planned.
- Plan logging and monitoring (rotate logs, send to central SIEM).
- Plan firewall and network considerations: ports, NAT, and passive/active transfer modes.
Step 2 — Install TSFTP server software
On Debian/Ubuntu (example using a package name tsftp-server — replace with your package):
sudo apt update sudo apt install tsftp-server On CentOS/RHEL:
sudo dnf install tsftp-server If installing from source or vendor-provided binaries, unpack and follow included README/install scripts. Ensure the tsftp service binary is placed in /usr/sbin or /opt/tsftp/bin and systemd unit file is installed.
Step 3 — Create service user and directories
Create a dedicated system user (no login) to run TSFTP and host uploads:
sudo useradd --system --shell /usr/sbin/nologin --home /var/lib/tsftp tsftp sudo mkdir -p /var/lib/tsftp/uploads /var/lib/tsftp/downloads sudo chown -R tsftp:tsftp /var/lib/tsftp sudo chmod 750 /var/lib/tsftp Create per-client or per-project directories if needed and set appropriate group permissions.
Step 4 — Configure TSFTP daemon
Locate the main config file (example paths: /etc/tsftp/tsftp.conf or /etc/tsftp.conf). Key settings to configure:
- Listening address and port (default often 22 or a custom port).
- Authentication methods: enable/disable password, public-key, TLS certs.
- Chroot directory per user or global.
- Max concurrent connections, transfer rate limits, and session timeouts.
- Logging level and log file path.
- Passive/active transfer mode settings (if applicable).
Example minimal configuration (pseudo-format — adapt to your TSFTP syntax):
ListenAddress 0.0.0.0 Port 2222 PermitPasswordAuth no PermitPublicKeyAuth yes ChrootDirectory /var/lib/tsftp/%u MaxSessions 10 LogLevel INFO LogFile /var/log/tsftp/tsftp.log After editing, test syntax if the server provides a config-check option, then reload/restart the service:
sudo systemctl daemon-reload sudo systemctl enable --now tsftp sudo systemctl status tsftp Step 5 — Set up user accounts and authentication
Option A — Password-based users (not recommended for high-security):
sudo adduser --home /var/lib/tsftp/alice --shell /usr/sbin/nologin alice sudo passwd alice sudo chown root:root /var/lib/tsftp/alice sudo chmod 755 /var/lib/tsftp/alice mkdir /var/lib/tsftp/alice/uploads chown alice:tsftp /var/lib/tsftp/alice/uploads Option B — Public-key authentication (recommended)
- On client machine, generate key pair:
ssh-keygen -t ed25519 -C "alice@client" -f ~/.ssh/tsftp_ed25519 - Copy public key to server (replace paths to match TSFTP’s authorized keys location):
sudo mkdir -p /var/lib/tsftp/alice/.ssh sudo chown alice:alice /var/lib/tsftp/alice/.ssh sudo chmod 700 /var/lib/tsftp/alice/.ssh sudo tee /var/lib/tsftp/alice/.ssh/authorized_keys <<< "ssh-ed25519 AAAAC3... alice@client" sudo chmod 600 /var/lib/tsftp/alice/.ssh/authorized_keys - Ensure TSFTP configuration permits public-key auth and sets AuthorizedKeysFile to the correct location.
Option C — TLS client certs
If TSFTP supports TLS mutual authentication, create a CA, sign client certs, and configure the server to verify client certs. This is more complex and depends on TSFTP implementation.
Step 6 — Chroot/Jail hardening
To restrict users to their home directories, configure chroot. Common pitfalls: chroot directories must be owned by root and not writable by the chrooted user.
Example permissions for chrooted user directory:
sudo chown root:root /var/lib/tsftp/alice sudo chmod 755 /var/lib/tsftp/alice sudo mkdir -p /var/lib/tsftp/alice/uploads sudo chown alice:tsftp /var/lib/tsftp/alice/uploads If the TSFTP server requires certain binaries or libraries inside the chroot, prefer using SFTP-style in-server file operations or use bind mounts over copying system binaries.
Step 7 — Firewall and network configuration
Open the TSFTP port (example port 2222):
Ubuntu (ufw):
sudo ufw allow 2222/tcp sudo ufw reload CentOS (firewalld):
sudo firewall-cmd --add-port=2222/tcp --permanent sudo firewall-cmd --reload If using passive transfer ranges, open those ports and configure NAT for passive connections behind a NAT gateway.
Step 8 — TLS certificates (optional)
If TSFTP supports TLS, use Let’s Encrypt or a commercial CA for server certificates, or internal CA for private deployments.
Using certbot (if TSFTP accepts PEM files):
sudo apt install certbot sudo certbot certonly --standalone -d tsftp.example.com sudo cp /etc/letsencrypt/live/tsftp.example.com/fullchain.pem /etc/tsftp/server.crt sudo cp /etc/letsencrypt/live/tsftp.example.com/privkey.pem /etc/tsftp/server.key sudo chown root:root /etc/tsftp/server.* sudo chmod 600 /etc/tsftp/server.key sudo systemctl restart tsftp Configure automatic renewal hooks to reload the TSFTP service after cert renewal.
Step 9 — Logging, monitoring, and rotation
Configure logrotate for TSFTP logs (example /etc/logrotate.d/tsftp):
/var/log/tsftp/tsftp.log { daily rotate 14 compress missingok notifempty create 640 tsftp adm postrotate systemctl reload tsftp > /dev/null 2>/dev/null || true endscript } Forward logs to a central logging service (syslog, rsyslog, or an ELK/SIEM) for audit and alerting.
Monitor service health with systemd service checks and use tools like monit, Prometheus + exporters, or simple cron-based probes.
Step 10 — Testing TSFTP server
From a client machine:
- Test connection and authentication:
tsftp -p 2222 [email protected] - Upload a file:
put localfile.txt /uploads/localfile.txt - Download a file:
get /downloads/remotefile.bin ./remotefile.bin - Verify permission boundaries (attempt to access parent directories).
Check server logs for successful and failed attempts.
Step 11 — Automation and integration
- Automate backups using scripts or tools (rsync over TSFTP if supported).
- Integrate with CI/CD pipelines for artifact uploads.
- Use configuration management (Ansible/Chef/Puppet) to deploy consistent TSFTP configs and users.
- Consider mounting remote storage (S3 gateway, NFS) for large-scale storage and configure TSFTP to operate on those mounts.
Troubleshooting common issues
- Permission denied: check chroot ownership (must be root) and inner upload dir permissions.
- Key rejected: verify authorized_keys file path and file permissions.
- Cannot bind port: ensure no other service uses the port and you have privileges (ports <1024 need root).
- Passive transfers fail: open passive port range in firewall and ensure NAT is configured.
- Service won’t start: check journalctl -u tsftp and fix config syntax errors.
Security checklist
- Use public-key authentication or TLS client certs; disable password auth.
- Keep TSFTP server software and OS patched.
- Enforce strong ciphers and protocols if TLS is used.
- Limit login attempts and enable account lockouts or fail2ban.
- Run TSFTP with least privilege (dedicated user).
- Audit logs regularly and alert on suspicious activity.
- Use network-level restrictions (VPN, allowlist) for sensitive deployments.
Example: Minimal Ansible playbook snippet (create user and directories)
- hosts: tsftp_servers become: true tasks: - name: Create tsftp user user: name: alice home: /var/lib/tsftp/alice shell: /usr/sbin/nologin state: present - name: Create chroot dirs file: path: "{{ item }}" state: directory owner: "{{ 'root' if item == '/var/lib/tsftp/alice' else 'alice' }}" group: "{{ 'root' if item == '/var/lib/tsftp/alice' else 'tsftp' }}" mode: "{{ '0755' if item == '/var/lib/tsftp/alice' else '0750' }}" loop: - /var/lib/tsftp/alice - /var/lib/tsftp/alice/uploads Conclusion
This tutorial covered planning, installation, configuration, hardening, testing, and automation for a TSFTP server. Adjust paths, filenames, and commands to match the specific TSFTP implementation you use. If you share which OS and TSFTP software you plan to use, I can provide a tailored configuration file and exact commands.
Leave a Reply