Re: Is FTP through haproxy at all viable?

2015-05-09 Thread Rainer Duffner
I consider openssh for sftp pretty much unusable for clients/customers. I wouldn’t say that. Certainly true if they don’t actually know what they’re doing. As for the setup: yes, the first directory users can write to in a chroot-setup is a subdirectory of the home directory (because $HOME

Re: Is FTP through haproxy at all viable?

2015-05-09 Thread Dennis Jacobfeuerborn
On 09.05.2015 21:50, Shawn Heisey wrote: On 5/9/2015 11:43 AM, Dennis Jacobfeuerborn wrote: Most FTP clients these days support SFTP as well and if you use say proftpd+mod_sftp then handling SFTP on the server side become pretty much identical to handling FTP (except all that active/passive

Re: Is FTP through haproxy at all viable?

2015-05-09 Thread Shawn Heisey
On 5/9/2015 2:04 AM, Malcolm Turnbull wrote: LVS with FTP works fine in the current kernels but does need the correct firewall modules loaded + conntrack enabled. I was really hoping to avoid that, but the more I've read, the more I've dreaded that the firewall would be required. Setting it up

Re: Is FTP through haproxy at all viable?

2015-05-09 Thread Shawn Heisey
On 5/9/2015 11:43 AM, Dennis Jacobfeuerborn wrote: Most FTP clients these days support SFTP as well and if you use say proftpd+mod_sftp then handling SFTP on the server side become pretty much identical to handling FTP (except all that active/passive nonsense goes away an nobody can simply

Is FTP through haproxy at all viable?

2015-05-08 Thread Shawn Heisey
I have a load balancer setup with both haproxy and LVS-NAT. The LVS-NAT is giving us high availability for FTP. When I tried migrating everything from CentOS 5, where it all works, to Ubuntu 14 (for the newer kernel and because I find debian-based systems far easier to use), everything worked

Re: Is FTP through haproxy at all viable?

2015-05-08 Thread Ben Timby
With some iptables rules you can use FTP active and passive mode via haproxy. The key is to assign unique passive port ranges to each backend then port forward those ranges. You must be able to configure each FTP server daemon with it's own range. You must also be able to configure your FTP

Re: Is FTP through haproxy at all viable?

2015-05-08 Thread Baptiste
On Fri, May 8, 2015 at 4:02 PM, Shawn Heisey hapr...@elyograg.org wrote: I have a load balancer setup with both haproxy and LVS-NAT. The LVS-NAT is giving us high availability for FTP. When I tried migrating everything from CentOS 5, where it all works, to Ubuntu 14 (for the newer kernel and

Re: Is FTP through haproxy at all viable?

2015-05-08 Thread Shawn Heisey
On 5/8/2015 8:39 AM, Ben Timby wrote: With some iptables rules you can use FTP active and passive mode via haproxy. The key is to assign unique passive port ranges to each backend then port forward those ranges. You must be able to configure each FTP server daemon with it's own range.