Ubuntu SFTP 使用 SSL 加密的正确做法
概念澄清
方案一 加固 SFTP over SSH(推荐)
sudo apt update && sudo apt install openssh-server/etc/ssh/sshd_config,在文件末尾加入:Subsystem sftp internal-sftp
Match Group sftpusers
ChrootDirectory %h
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
PasswordAuthentication yes
PubkeyAuthentication yes
sudo adduser sftpuser
sudo usermod -aG sftpusers sftpuser
sudo chown root:root /home/sftpuser
sudo chmod 755 /home/sftpuser
sudo mkdir /home/sftpuser/upload
sudo chown sftpuser:sftpuser /home/sftpuser/upload
/etc/ssh/sshd_config 的全局或 Match 段中加入:Protocol 2
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_rsa_key
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
KexAlgorithms curve25519-sha256,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
sudo systemctl restart sshsftp sftpuser@your_server_ipssh -v sftpuser@your_server_ip 或在客户端查看加密套件协商结果。sudo ufw allow ssh(默认端口 22/TCP)方案二 使用 FTPS(FTP over SSL/TLS)
sudo apt update && sudo apt install vsftpd opensslsudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/vsftpd.key -out /etc/ssl/certs/vsftpd.crt/etc/vsftpd.conf,确保包含:anonymous_enable=NO
local_enable=YES
write_enable=YES
chroot_local_user=YES
allow_writeable_chroot=YES
ssl_enable=YES
rsa_cert_file=/etc/ssl/certs/vsftpd.crt
rsa_private_key_file=/etc/ssl/private/vsftpd.key
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
sudo systemctl restart vsftpdsudo ufw allow 21/tcp;若使用被动模式,还需放行数据端口段(示例):sudo ufw allow 40000:50000/tcp常见误区与验证
sshd_config 中添加 HostKey /etc/ssl/private/... 或 CertificateFile ... 并不会让 SFTP 走 SSL/TLS;SSH 不使用 x509 证书进行传输加密。上述做法适用于 HTTPS/SSL 类服务,不适用于 SFTP。sftp user@host 或 sftp -oPort=22 user@host;如需查看协商细节,用 ssh -v user@host。