Improve connection from AWS Balancers.

[pilchita]

I would like to know whether it is possible to do this:

sftp -P 2020 [email protected] => SFTPGo Server => SFTP Final Server.

Regards.

[drakkan]

Hi,

yes this is supported, you can define an SFTP storage backed for the user john. Take a look at the getting started guide. The AWS balancer must be configured to send the proxy header "on first ack", more details here

[pilchita]

Thanks for the reply. I already have everything configured in SFTPGo I can connect directly to the instance where the service is installed, I have also created all the users with their respective endpoints but when I tried to connect directly to the AWS balancer there was no answer.
I will contact Amazon Support to change such settings.
Excuse my English is not good.

Regards,

[drakkan]

Thanks for the reply. I already have everything configured in SFTPGo I can connect directly to the instance where the service is installed, I have also created all the users with their respective endpoints but when I tried to connect directly to the AWS balancer there was no answer. I will contact Amazon Support to change such settings. Excuse my English is not good.

Regards,

No problem for English, mine isn't perfect either. The suggested setting is relevant only if you enabled the proxy protocol (so SFTPGo can retrieve the original client IP instead of the proxy one). If you disable the proxy protocol a TCP proxy should work

[pilchita]

The proxy_protocol parameter is set to 0 in the configuration file /etc/sftpgo/sftpgo.json, I understand it is disabled, according to documentation (https://github.com/drakkan/sftpgo/blob/main/docs/full-configuration.md)
`
[root@ip-10-54-130-208 sftpgo]# grep proxy sftpgo.json

"proxy_protocol": 0,

"proxy_allowed": [],

    "apply_proxy_config": true

    "apply_proxy_config": true,

    "proxy_allowed": []

    "proxy_allowed": [],

`

When I try to connect using sftp through the host of the network ballader I see this error:

sftp -P 2022 sftpuser01@NLB-Balanceapps-xxxxxxxxxxxxxx.elb.us-west-2.amazonaws.com
ssh: connect to host nlb-balanceapps-xxxxxxxxxxxxxxxxxx.elb.us-west-2.amazonaws.com port 2022: Connection timed out
Connection closed.  
Connection closed

In the logs i see this error:

Apr 28 13:18:14 ip-10-54-130-208 sftpgo: {"level":"debug","time":"2022-04-28T13:18:14.817","sender":"connection_failed","client_ip":"10.54.200.160","username":"","login_type":"no_auth_tryed","protocol":"SSH","error":"EOF"}
Apr 28 13:18:24 ip-10-54-130-208 sftpgo: {"level":"debug","time":"2022-04-28T13:18:24.817","sender":"connection_failed","client_ip":"10.54.200.160","username":"","login_type":"no_auth_tryed","protocol":"SSH","error":"EOF"}
Apr 28 13:18:34 ip-10-54-130-208 sftpgo: {"level":"debug","time":"2022-04-28T13:18:34.817","sender":"connection_failed","client_ip":"10.54.200.160","username":"","login_type":"no_auth_tryed","protocol":"SSH","error":"EOF"}
Apr 28 13:18:44 ip-10-54-130-208 sftpgo: {"level":"debug","time":"2022-04-28T13:18:44.817","sender":"connection_failed","client_ip":"10.54.200.160","username":"","login_type":"no_auth_tryed","protocol":"SSH","error":"EOF"}

I think it is a problem at the firewall level but from the instance where the SFTPGo service is installed if I can connect to the other destination instance.

nc -v 172.31.x.x 38922
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Connected to 172.31.x.x:38922.
SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u3

Maybe I’m missing some additional configuration? I apologize for so many questions.

Regards,

[drakkan]

The proxy_protocol parameter is set to 0 in the configuration file /etc/sftpgo/sftpgo.json, I understand it is disabled, according to documentation (https://github.com/drakkan/sftpgo/blob/main/docs/full-configuration.md) ` [root@ip-10-54-130-208 sftpgo]# grep proxy sftpgo.json

I mean the proxy protocol in your load balancer configuration, check that it is disabled there or that is configured to send the header "on first ack"

"proxy_protocol": 0,

"proxy_allowed": [],

    "apply_proxy_config": true

    "apply_proxy_config": true,

    "proxy_allowed": []

    "proxy_allowed": [],

`

When I try to connect using sftp through the host of the network ballader I see this error:

sftp -P 2022 sftpuser01@NLB-Balanceapps-xxxxxxxxxxxxxx.elb.us-west-2.amazonaws.com
ssh: connect to host nlb-balanceapps-xxxxxxxxxxxxxxxxxx.elb.us-west-2.amazonaws.com port 2022: Connection timed out
Connection closed.  
Connection closed

In the logs i see this error:

` Apr 28 13:18:14 ip-10-54-130-208 sftpgo: {"level":"debug","time":"2022-04-28T13:18:14.817","sender":"connection_failed","client_ip":"10.54.200.160","username":"","login_type":"no_auth_tryed","protocol":"SSH","error":"EOF"} Apr 28 13:18:24 ip-10-54-130-208 sftpgo: {"level":"debug","time":"2022-04-28T13:18:24.817","sender":"connection_failed","client_ip":"10.54.200.160","username":"","login_type":"no_auth_tryed","protocol":"SSH","error":"EOF"} Apr 28 13:18:34 ip-10-54-130-208 sftpgo: {"level":"debug","time":"2022-04-28T13:18:34.817","sender":"connection_failed","client_ip":"10.54.200.160","username":"","login_type":"no_auth_tryed","protocol":"SSH","error":"EOF"} Apr 28 13:18:44 ip-10-54-130-208 sftpgo: {"level":"debug","time":"2022-04-28T13:18:44.817","sender":"connection_failed","client_ip":"10.54.200.160","username":"","login_type":"no_auth_tryed","protocol":"SSH","error":"EOF"}

these appear to be the "pings" from the proxy to check if the service is active. I can see logs like these locally if I setup a load balancer using haproxy for example.

I guess no connections are forwarded to SFTPGo if you don't see any other logs and your client times out

`

Maybe I’m missing some additional configuration? I apologize for so many questions.

Regards,

[pilchita]

Hi, I am here again, the network balancer has already been modified but I receive an error.

{
    "Attributes": [
        {
            "Key": "proxy_protocol_v2.enabled",
            "Value": "false"
        },
        {
            "Key": "preserve_client_ip.enabled",
            "Value": "true"
        },
        {
            "Key": "stickiness.enabled",
            "Value": "false"
        },
        {
            "Key": "proxy_protocol_v2.client_to_server.header_placement",
            "Value": "on_first_ack"
        },
        {
            "Key": "deregistration_delay.timeout_seconds",
            "Value": "300"
        },
        {
            "Key": "stickiness.type",
            "Value": "source_ip"
        },
        {
            "Key": "deregistration_delay.connection_termination.enabled",
            "Value": "false"
        }
    ]
}

Error log:

May  5 21:04:28 ip-10-54-130-208 sftpgo: {"level":"debug","time":"2022-05-05T21:04:28.385","sender":"sftpd","message":"failed to accept an incoming connection: EOF"}
May  5 21:04:28 ip-10-54-130-208 sftpgo: {"level":"debug","time":"2022-05-05T21:04:28.385","sender":"connection_failed","client_ip":"10.54.200.160","username":"","login_type":"no_auth_tryed","protocol":"SSH","error":"EOF"}

Is it possible to enable some complete log type in sftpgo to know where the problem is?

Any additional help for me?

[drakkan]

the logs above looks like a keepalive from the loadbalancer. You are paying for AWS services and you are using SFTPGo for free, I suggest to contact the AWS support. If you test SFTPGo locally behind haproxy or nginx you can see that it works fine