Re: Is FTP through haproxy at all viable?

2015-05-09 Thread Rainer Duffner
> > I consider openssh for sftp pretty much unusable for clients/customers. I wouldn’t say that. Certainly true if they don’t actually know what they’re doing. As for the setup: yes, the first directory users can write to in a chroot-setup is a subdirectory of the home directory (because $HOM

Re: Is FTP through haproxy at all viable?

2015-05-09 Thread Dennis Jacobfeuerborn
On 09.05.2015 21:50, Shawn Heisey wrote: > On 5/9/2015 11:43 AM, Dennis Jacobfeuerborn wrote: >> Most FTP clients these days support SFTP as well and if you use say >> proftpd+mod_sftp then handling SFTP on the server side become pretty >> much identical to handling FTP (except all that active/pass

Re: Is FTP through haproxy at all viable?

2015-05-09 Thread Shawn Heisey
On 5/9/2015 11:43 AM, Dennis Jacobfeuerborn wrote: > Most FTP clients these days support SFTP as well and if you use say > proftpd+mod_sftp then handling SFTP on the server side become pretty > much identical to handling FTP (except all that active/passive nonsense > goes away an nobody can simply

Re: Is FTP through haproxy at all viable?

2015-05-09 Thread Dennis Jacobfeuerborn
On 09.05.2015 16:15, Shawn Heisey wrote: > On 5/9/2015 2:04 AM, Malcolm Turnbull wrote: >> LVS with FTP works fine in the current kernels but does need the >> correct firewall modules loaded + conntrack enabled. > > I was really hoping to avoid that, but the more I've read, the more I've > dreaded

Re: Is FTP through haproxy at all viable?

2015-05-09 Thread Shawn Heisey
On 5/9/2015 2:04 AM, Malcolm Turnbull wrote: > LVS with FTP works fine in the current kernels but does need the > correct firewall modules loaded + conntrack enabled. I was really hoping to avoid that, but the more I've read, the more I've dreaded that the firewall would be required. Setting it u

Re: Is FTP through haproxy at all viable?

2015-05-08 Thread Shawn Heisey
On 5/8/2015 8:39 AM, Ben Timby wrote: > With some iptables rules you can use FTP active and passive mode via > haproxy. > > The key is to assign unique passive port ranges to each backend then > port forward those ranges. You must be able to configure each FTP server > daemon with it's own range.

Re: Is FTP through haproxy at all viable?

2015-05-08 Thread Ben Timby
With some iptables rules you can use FTP active and passive mode via haproxy. The key is to assign unique passive port ranges to each backend then port forward those ranges. You must be able to configure each FTP server daemon with it's own range. You must also be able to configure your FTP daemo

Re: Is FTP through haproxy at all viable?

2015-05-08 Thread Baptiste
On Fri, May 8, 2015 at 4:02 PM, Shawn Heisey wrote: > I have a load balancer setup with both haproxy and LVS-NAT. The LVS-NAT > is giving us high availability for FTP. > > When I tried migrating everything from CentOS 5, where it all works, to > Ubuntu 14 (for the newer kernel and because I find

Is FTP through haproxy at all viable?

2015-05-08 Thread Shawn Heisey
I have a load balancer setup with both haproxy and LVS-NAT. The LVS-NAT is giving us high availability for FTP. When I tried migrating everything from CentOS 5, where it all works, to Ubuntu 14 (for the newer kernel and because I find debian-based systems far easier to use), everything worked exc