Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

OK, this is probably a really basic DNS question, so sorry...

My small one-person company's domain, mikekellyconsulting.com, is hosted by Web.COM (a/k/a Interland) on a Windows hosting plan. Apparently they don't support SFTP. I need an SFTP site where clients can securely copy large amounts of data (probably 10 - 20 GB per engagement). I want them to be able to use any SFTP client they have.

I've poked around a bit on the web and found some places that will offer SFTP hosting but it seems ridiculously expensive - like $60/month for 10 GB. I'll pay $720 per year if I absolutely have to, but I'm looking at alternatives. I thought about setting up my own Linux server in my office, but that seems like a lot of work for a simple need. Since SFTP seems way easier under Unix than Windows (true?) I figured I'd just set up a Red Hat Linux Server at Amazon Web Services and probably end up paying less than $60 per month - in addition to getting some experience with AWS.

So here's my question: I want the address that people connect to to be sftp.mikekellyconsulting.com (another reason not to use one of the services - I doubt they could offer me this). This is for a professional look, as well as to resolve any concerns about who is controlling the secure FTP site they are copying confidential data to.

My DNS records at Web.COM look like this:

Record              Type    Resolves To      TTL
mikekellyconsulting.com     A   209.237.151.16           1 hour
ftp.mikekellyconsulting.com     CNAME   mikekellyconsulting.com  1 hour        
www.mikekellyconsulting.com     CNAME   mikekellyconsulting.com  1 hour
mikekellyconsulting.com     NS  c.ns.interland.net   1 day         
mikekellyconsulting.com     NS  b.ns.interland.net       1 day         
mikekellyconsulting.com     NS  a.ns.interland.net       1 day 

So suppose I get an AWS S3 account - can I just add a DNS record to make it sftp.mikekellyconsulting.com and map it to something on Amazon S3? Has anyone done this? Any gotchas? What would this DNS record look like?

Thanks for any pointers or guidance here.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Amazon S3 does not provide SFTP access. If you want to give users the ability to securely upload and/or download files straight to S3 then it will have to be via HTTPS POST/GET and you'll have to directly use the s3.amazonaws.com domain due to the [wildcard] SSL certificate. For non-SSL requests, you can use CNAMEs and S3 "Virtual Hosting":

http://docs.amazonwebservices.com/AmazonS3/latest/index.html?VirtualHosting.html

share|improve this answer
    
Thanks - so is the best solution here just to set up my own Linux server with a static IP address from my ISP and direct sftp.xxx.com to it as indicated above with an "A" DNS record? –  Mike Kelly Sep 12 '10 at 6:32
    
@Mike Kelly Basically yes and make sure you provide your clients with the SSH fingerprint of the server (in a secure manner of course :) so they can verify they aren't victims of a "Man In The Middle" attack. Also, you can do other things like a TrueCrypt volume to protect data "at rest" or use GnuPG to encrypt the files if you're going to be storing anything on S3. –  Rob Olmos Sep 12 '10 at 20:31
    
OK -Rob, thanks a lot for your help. So here's one more question. I have now set up a Open SUSE Linux server which is on my local lan at 192.168.2.102. I have a DSL connection the IP address of which is x.y.z.a. I set up port forwarding on my DSL modem so that port 22 is forwarded to 192.168.2.102. The problem is that if I connect from a machine on my LAN to 192.168.2.102, it works - I get an SFTP connection. But if instead I use the public facing IP x.y.z.a it times out. Shouldn't the port forwarding make these equivalent, or am I missing something? Thanks again for your help. –  Mike Kelly Sep 13 '10 at 1:19
    
@Mike Kelly Try the WAN IP from outside of your LAN. I don't usually have good results with the WAN IP within the LAN with ISP modems. –  Rob Olmos Sep 13 '10 at 1:57

Yeah, that should be doable. Add an A record pointing to the IP of the VM:

sftp.mikekellyconsulting.com  A  1.2.3.4
share|improve this answer
    
I prefer to keep things simple :) upvoted –  Mister IT Guru Feb 2 '11 at 14:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.