I am trying to get WinSCP working with ASL3. I am using file protocol SFTP. SFTP server is: ' sudo su /usr/lib/sftp-server '. Preferred SFTP protocal set to ' auto '. Logging in, I get the error: Cannot initialize SFTP protocol. Is the host running an SFTP server? I have confirmed the SFTP location, and that the server IS running.
I don't know what you mean by this. Are you trying to use that as the address of the ASL3 host?
Long time user of WinSCP on a 2018 Debian voter system and Arch Linux HamVoIP public nodes. When our voter system crashed I too struggled getting WinSCP to work on a fresh build of Debian 13 (amd64) and ASL3. A few Google AI searches resulted in these notes copied below that I saved to a Word file. Hope it helps your situation.
debian passwordless sudo winscp not working
1. Configure Passwordless Sudo on Debian
You must give your user permission to execute the SFTP server command as root without a password by editing the sudoers file.
-
Connect to your Debian server via an SSH terminal (like PuTTY).
-
Run sudo visudo to safely edit the sudoers file.
-
Add the following line to the bottom of the file (replace yourusername with your actual username): repeater ALL=(ALL) NOPASSWD: ALL
/usr/lib/openssh/sftp-serverNote: Using the specific path to the SFTP binary is more secure than a blanket NOPASSWD: ALL.
-
Save and exit
2. Configure WinSCP to Use Sudo
You must tell WinSCP to specifically call the SFTP server via sudo during the login process.
- Open the WinSCP Site Manager and select your session.
- Click Edit > Advanced...
- Navigate to Environment > SFTP.
- In the SFTP server field, replace "Default" with:
sudo -s /usr/lib/openssh/sftp-server (copy and paste this in to WinSCP box) - Save and exit
This is not something you need to touch or worry about. ASL3 comes preconfigured with the sftp-server as the default subsystem. There are a lot of cases in which one needs to use the sftp advanced setting. This is not one of them.
As far as running the thing as root; you can get around that. The reason you usually need to is to bypass permissions. So if you want to poke your configs in /etc/asterisk, your normal user doesn't have permissions; running as root over-rides that. However I still feel like this is a security risk. Going full NOPASSWD is crazy and something that should never be recommended. Locking NOPASSWD to just the sftp binary is fine.
The best/easiest solution is to just put your user in to the asterisk group, and modify the permissions to allow group write access. The easiest solution would be just chmod -R 777 /etc/asterisk/ - since you're not running these things with a bunch of other users...this is what I feel is the best compromise for convenience. If someone does somehow gain access and compromise your user account...then at least the blast radius is just the asterisk folder. They're not then further taking that and abusing the sftp access to delete other things.
Thanks Kevin. Not sure on step 4. Is this the line to add for user asletsnj?
asletsnj ALL=(ALL)NOPASSWD:ALL
I followed everything you posted, and still no WinSCP,
Plainly speaking, that's not how a bog standard SFTP server works, it's not meant to be run directly. It's meant to be run by the SSH daemon. Maybe if you were running it on a system which for some reason wasn't running a SSH daemon and you had a purpose-compiled SFTP server, you might run it directly, but that's generally not the case.
Plus, there is absolutely, positively no reason I know of to "sudo su" anything. All it does is consume an extra process table slot and needlessly add to any logging. There may be edge cases where for example the PAM configuration for su differs from sudo, so initializes or checks SOMETHING differently, but that would be quite rare. sudo has many options, like -H to set the HOME variable, -i for launching an interactive shell (which IMHO should be rare from a sysadmin perspective), and so on, making chaining su with sudo superfluous at best and as mentioned above, an auditing headache at worst when things go amiss.
Literally none of the configuration being discussed here is needed to SFTP files from WinSCP to an ASL3 node. Enter the hostname, username, and password and it'll just work. By default, files will end up in /home/$USER for whatever your username is. Obviously you can't overwrite files that are only writable by root. The best choice is to copy them over to your home directory and then use the console via SSH or Cocpkit to move the files into place as root (i.e. sudo cp or sudo -s). There is no reason to modify /etc/sudoers or try to call sftp-server or anything.
There are....two reasons off the top of my head you would need to:
- the sftp subsystem in sshd is misconfigured or not configured
- you're on an embedded system using busybox, see rule 1
At the root is just the fact people giving the advice don't know the operating system. They only know "what worked for them"...which may be the most insecure solution ever....or they maybe pieced together information that got them there...but for the wrong reasons.
I mean to start with you can't sudo su an application because that's not how su even works. Running it alone will elevate you to root. Running sudo su will elevate you to root. sudo su /some/application just confuses it since it's expecting a userid argument.
The crux of the problem is old advice getting applied where it doesn't belong as well as badly translated. This advice may have been required 20 years ago; but not today. It may have been required on some really old node builds; but not today.
The reason people are doing it is because they're trying to bypass permissions; running the sftp-server will basically give them root access to the file system. It worked for one guy...he told everyone else...those guys told everyone else...and a bunch of people who don't know the OS are spreading this around like it's a requirement. I can also point to a situtation where I said "don't do this, it's wrong" and the person did the wrong thing anyway like they didn't even bother reading what I said. You can't help that people will reject good advice because they trust the wrong person more.
That being said...I have an embedded linux build that you actually do have to manually start the sftp server up because it's absolutely bare bones. So there are reasons for calling the sftp-daemon that way; but like I said....ASL3 is not one of them.
That you Jason, and everyone, for the excellent feedback. All the other ideas are just noise. " Enter the hostname, username, and password and it'll just work " is correct. Then, to avoid permission issues, ' chmod -R 777 /etc/asterisk '.
Then, to avoid permission issues, ' chmod -R 777 /etc/asterisk '.
If you're going down this route (making everything in /etc/asterisk writable) then it would be better to use the following :
chmod -R ugo+rwX /etc/asterisk
This will "add read permissions", "add write permissions", and "add execute/search permissions to directories" ... and this is marginally safer because you are not marking random files as executable.
Maybe this will. It allows Winscp to sudo su - when it connects.