SSL Certificate on the FTP server

[soulman]

As above, when will it be fixed?

[yourepicfailure]

AFAIK, it is not due to the certificate per se. It's due to the encryption method being too out-dated because of the current FTP software.

My guess is whenever the mrp and/or Andy can migrate to a newer software. And a timeline for this has not been announced as of yet.

[daemonspudguy]

As devs say when asked fo an ETA, Soon.™

[Stannieman]

AFAIK, it is not due to the certificate per se. It's due to the encryption method being too out-dated because of the current FTP software.

My guess is whenever the mrp and/or Andy can migrate to a newer software. And a timeline for this has not been announced as of yet.

I think this can happen rather soon. AFAIK the main reason for this was that the FTP server needed to have a feature to serve multiple filesystem directories as "1 FTP volume". This was needed for the old storage setup and only an older version of one specific server could do that. With the new storage setup everything is already in 1 big directory so we can use pretty much any FTP server available.
And by soon I don't mean next week, I mean that at least the main blocker here has been fixed so the roads are open.

[mrpijey]

It's not that easy. While we've removed the folder merging requirements there's still the matter of account management, which is done by script. And the script relies on the FTP server to reload the config every now and then, something other don't do. And we would also need to write completely new account management scripts for different FTP server software (if we can find any that works the same way).

[Stannieman]

Ah ok yes that makes sense. I expected that this was some kind of standard (surely BA is not the only one to integrate auth with other system), but if it isn't then indeed.
But anyway a lot of Linux server software is able to hot reload config AFAIK, so I think if you take a Windows flavour of a common Linux server it might be able to do it.
Bu I didn't do any research and mrpijey obviously did so I should shut up

[soulman]

Thanks all for being BA spokespeople

And we would also need to write completely new account management scripts for different FTP server software (if we can find any that works the same way).

Out of curiosity what is the FTP daemon in use?

[mrpijey]

We're currently using Gene6 FTP server which unfortunately is abandoned today and development is dead. But it was the only FTP software that could do folder and subfolder merging AND it had a method where it would read in the user configs periodically, something we use today when we directly manipulate the config files to set ratio and permissions for every user. We build our whole FTP infrastructure on these features, and while the folder merging functions are not needed anymore the rest is, and until we find other ways to manipulate and read these data we can't easily switch to other software.

[ibmpcat5170]

mrpijey: Maybe you can use FileZilla Server to migrate from Gene6...

[x010]

mrpijey: Maybe you can use FileZilla Server to migrate from Gene6...

My understanding is that it does not support the feature set required for the migration.

[Darkstar]

There are many possible alternative FTP servers, but none that are a drop-in replacements, they would all require some scripting/plumbing to the user account system. Since nobody stepped forward to do this work, and with all the recent talk about outsourcing the archive and opening it up more, I am not sure if this will ever get fixed (at least if the decision to outsource the FTP will pass)

[bluecmd]

Sorry if I am missing existing discussion, but couldn't you put any SSL/TLS terminator in front of the FTP server on your backend, effectively replacing the SSL/TLS stack as seen by the client? Given that you are using implicit TLS that should work, no?