= Tahoe SFTP Frontend =

All Tahoe client nodes can run a frontend SFTP server, allowing regular SFTP
clients to access the virtual filesystem.

Since Tahoe does not use user accounts or passwords, the FTP server must be
configured with a way to translate a username (and either a password or
public key) into a root directory cap. Two mechanisms are provided. The first
is a simple flat file with one account per line. The second is an HTTP-based
login mechanism, backed by simple PHP script and a database. The latter form
is used by allmydata.com to provide secure access to customer rootcaps.

The SFTP server must also be given a public/private host keypair.

== Configuring a Keypair ==

First, generate a keypair for your server:

% cd BASEDIR
% ssh-keygen -f private/ssh_host_rsa_key

You will then use the following lines in the tahoe.cfg file:

 [sftpd]
 sftp.host_pubkey_file = private/ssh_host_rsa_key.pub
 sftp.host_privkey_file = private/ssh_host_rsa_key

== Configuring an Account File ==

To configure the first form, create a file (probably in
BASEDIR/private/sftp.accounts) in which each non-comment/non-blank line is a
space-separated line of (USERNAME, PASSWORD/PUBKEY, ROOTCAP), like so:

[TODO: the PUBKEY form is not yet supported]

 % cat BASEDIR/private/sftp.accounts
 # This is a password file, (username, password/pubkey, rootcap)
 alice password URI:DIR2:ioej8xmzrwilg772gzj4fhdg7a:wtiizszzz2rgmczv4wl6bqvbv33ag4kvbr6prz3u6w3geixa6m6a
 bob sekrit URI:DIR2:6bdmeitystckbl9yqlw7g56f4e:serp5ioqxnh34mlbmzwvkp3odehsyrr7eytt5f64we3k9hhcrcja
 carol ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAv2xHRVBoXnwxHLzthRD1wOWtyZ08b8n9cMZfJ58CBdBwAYP2NVNXc0XjRvswm5hnnAO+jyWPVNpXJjm9XllzYhODSNtSN+TXuJlUjhzA/T+ZwdgsgSAeHuuMQBoWt4Qc9HV6rHCdAeMhcnyqm6Q0sRAsfA/wfwiIgbvE7+cWpFa2anB6WeAnvK8+dMN0nvnkPE7GNyf/WFR1Ffuh9ifKdRB6yDNp17bQAqA3OWSFjch6fGPhp94y4g2jmTHlEUTyVsilgGqvGOutOVYnmOMnFijugU1Vu33G39GGzXWla6+fXwTk/oiVPiCYD7A7WFKes3nqMg8iVN6a6sxujrhnHQ== warner@fluxx URI:DIR2:6bdmeitystckbl9yqlw7g56f4e:serp5ioqxnh34mlbmzwvkp3odehsyrr7eytt5f64we3k9hhcrcja

Note that if the second word of the line is "ssh-rsa" or "ssh-dss", the rest
of the line is parsed differently, so users cannot have a password equal to
either of these strings.

Then add the following lines to the BASEDIR/tahoe.cfg file:

 [sftpd]
 enabled = true
 sftp.port = 8022
 sftp.host_pubkey_file = private/ssh_host_rsa_key.pub
 sftp.host_privkey_file = private/ssh_host_rsa_key
 sftp.accounts.file = private/sftp.accounts

The SFTP server will listen on the given port number. The sftp.accounts.file
pathname will be interpreted relative to the node's BASEDIR.

== Configuring an Account Server ==

Determine the URL of the account server, say https://example.com/login . Then
add the following lines to BASEDIR/tahoe.cfg:

 [sftpd]
 enabled = true
 sftp.port = 8022
 sftp.host_pubkey_file = private/ssh_host_rsa_key.pub
 sftp.host_privkey_file = private/ssh_host_rsa_key
 sftp.accounts.url = https://example.com/login

== Dependencies ==

The Tahoe SFTP server requires the Twisted "Conch" component, which itself
requires the pycrypto package (note that pycrypto is distinct from the
pycryptopp that Tahoe uses).