[Solved for me]Distinguishing SSH and SFTP (for QoS purposes)

seiichiro0185 · 2010-08-18 07:23:20

Hi there,

I'm thinking about shutting down the FTP on my homeserver and use SFTP instead. There is only one thing I couldn't solve so far: In my router I have QoS-rules that make FTP low priority traffic so my normal activities don't get affected by the file transfers. I would like to have the same setup for the SFTP. Now the problem is this: SFTP and SSH are both coming from the same ssh server, listening on port 22. So there is no way of distinguishing them on a ip/port basis. Is there any way of distinguishing SFTP and SSH? Like using iptables to tag one of them and then doing QoS based on the tag or something along those lines? I don't want to slow down my ssh-connections together with the sftp. If anyone has an idea how to accomplish this I would be really glad to hear about it.

Thanks in advance
seiichiro0185

Last edited by seiichiro0185 (2010-08-22 11:27:32)

theDOC · 2010-08-18 08:53:25

sftp uses the same encrypted ssh connection as the shell to transfer the files. So from the outside it looks like you are typing A LOT. Just from the content, which is encrypted, my guess is, you cannot distinguish those two. Maybe you can look at the packet sizes and see if they differ from a normal session.

Noble · 2010-08-21 01:12:31

IIRC you can enable SFTP in proftd, and this would enable sftp over the regular FTP port.

This might work if your purpose is not to reduce the amount of services running.

I'd also look into rsync, it plays well over ssh.

fukawi2 · 2010-08-21 02:43:01

SFTP != scp. SFTP runs over port 115. You're talking about scp which uses SSH.

There's no way to do what you want -- interactive SSH and scp are both encrypted inside the same protocol. If the gateway could decrypt the traffic to QoS it then it would defeat the purpose of having it encrypted in the first place.

briest · 2010-08-21 11:03:08

Well, a simple, though definitely not bulletproof solution: define multiple ports in sshd_config, then use one of them for sftp, and another for ssh?

hexanol · 2010-08-21 21:29:08

Noble wrote:

IIRC you can enable SFTP in proftd, and this would enable sftp over the regular FTP port.

Did you mean FTPS ?

seiichiro0185 · 2010-08-22 09:03:52

briest wrote:

Well, a simple, though definitely not bulletproof solution: define multiple ports in sshd_config, then use one of them for sftp, and another for ssh?

Thanks for this hint, I didn't know that ssh could listen on multiple ports. Its not totally bulletproof, but good enough for my case. The only people who will have access to the server are trustworthy and won't fiddle with the settings to circumvent my restrictions.

Thanks to all of you for your suggestions.

Arch Linux

#1 2010-08-18 07:23:20

[Solved for me]Distinguishing SSH and SFTP (for QoS purposes)

#2 2010-08-18 08:53:25

Re: [Solved for me]Distinguishing SSH and SFTP (for QoS purposes)

#3 2010-08-21 01:12:31

Re: [Solved for me]Distinguishing SSH and SFTP (for QoS purposes)

#4 2010-08-21 02:43:01

Re: [Solved for me]Distinguishing SSH and SFTP (for QoS purposes)

#5 2010-08-21 11:03:08

Re: [Solved for me]Distinguishing SSH and SFTP (for QoS purposes)

#6 2010-08-21 21:29:08

Re: [Solved for me]Distinguishing SSH and SFTP (for QoS purposes)

#7 2010-08-22 09:03:52

Re: [Solved for me]Distinguishing SSH and SFTP (for QoS purposes)

Board footer