0

I am looking for a solution where I can setup a main "SFTP" forwarding server and send it to the relevant clients SFTP backend details so they get "forwarded" on sucessfully.

It's a little difficult to explain, so I will write it like this:

I connect to sftp.domain.com > This pops me into my own hosted system for all my clients > This recognises that domain and forwards the SFTP details I've put in (username, password, port) to the actual SFTP server it's meant to get to > They login and see the files.

This eliminates IP whitelisting for SFTP on the ports due to CloudFlare free plan, creating a VPN AND stops me from just opening port "2022" for example on a whim, leaving it exposed. (It's Pterodactyl, a standalone SFTP connector inside of the daemon)

I can then do ufw allow from <thatbox> and it will only auth against those requests coming from it. Simple!

How would I do this, and do I need something custom?

What if the client expands and has two systems? Can we do ports to depict which SFTP server it goes to, like sftp://sftp.domain.com:2022 for server 1 and sftp://sftp.domain.com:2023 for server 2 and the config realises how that works and forwards it on?

Or am I being stupid and need to get a custom solution, or is there an easier way like SFTP passthrough or something?

I am a system administrator for 5 years but I don't know everything, and this is our bottleneck in learning and I want to find out the best method. For now, we use OpenVPN with the client who has a dynamic IP OR using IP whitelisting if they have a static.

Any help would be appreciated.

Unfortunately not attempted anything currently except the two methods we know and works.

Improve this question
5
  • it sounds like you are looking for a reverse socks proxy.
    – Frank Thomas
    Commented Jan 23 at 17:16
  • 1
    I'm not sure if this is what you are looking for, but a different approach is to setup different subdomains at the DNS level. So let's say you have domain example.com - you can setup an A record that points sftp1.example.com to client1 server, sftp2.example.com to client2 server, and so on. The DNS is managed in CloudFlare, and there's no limit on the free plan for DNS entries.
    – Luis Alberto Barandiaran
    Commented Jan 23 at 17:19
  • I've seen this done with a single sftp server as the frontend system users connect to, where that server basically mounts the storage (of the actual destination server) a user has access to and roots the sftp user to it. It's more straightforward than a proxy at least and only requires one external node.
    – Cpt.Whale
    Commented Jan 23 at 17:40
  • @Cpt.Whale Know how to do this? I would love to know a solution haha. That sounds perfect.
    – JasmeowTheCat
    Commented Jan 23 at 17:42
  • It depends on your network setup, and you'd need to be knowledgeable about security/permissions to keep clients separate. If you're not sure, it may just be better to go with an MFT server software that is designed for this kind of thing. Most will let you host "folders" over sftp that can map to whatever you need on the backend
    – Cpt.Whale
    Commented Jan 23 at 17:49

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .