tahoe-lafs/trac-2024-07-25

Support encryptionless sftp using sftp-over-tcp #2369

New issue

Open

opened 2015-01-29 15:13:58 +00:00 by HoverHell · 5 comments

HoverHell commented

2015-01-29 15:13:58 +00:00

Owner

For performance reasons, it might be preferable to use unencrypted (and unauthenticated) sshfs, e.g. when running over localhost or a trusted local network.

For this, sshfs supports a directport=… option which skips the 'ssh' part and directly uses sftp protocol (for reference, the server-part of this can be started using socat TCP4-LISTEN:12345,bind=192.168.0.1 EXEC:/usr/lib/sftp-server,nofork)

(not sure whether this is a duplicate; I could not find anything relevant)

For performance reasons, it might be preferable to use unencrypted (and unauthenticated) sshfs, e.g. when running over localhost or a trusted local network. For this, `sshfs` supports a `directport=…` option which skips the 'ssh' part and directly uses sftp protocol (for reference, the server-part of this can be started using `socat TCP4-LISTEN:12345,bind=192.168.0.1 EXEC:/usr/lib/sftp-server,nofork`) (not sure whether this is a duplicate; I could not find anything relevant)

tahoe-lafs added the

labels 2015-01-29 15:13:58 +00:00

tahoe-lafs added this to the undecided milestone 2015-01-29 15:13:58 +00:00

daira commented

2015-01-29 16:07:03 +00:00

Author

Owner

I'm skeptical that encryption and authentication has a significant performance impact relative to other factors. HoverHell, can you measure that?

tahoe-lafs added

code-frontend-ftp-sftp

and removed

unknown

labels 2015-01-29 16:07:03 +00:00

HoverHell commented

2015-01-30 09:17:51 +00:00

Author

Owner

Apparently I can't answer that because of the spambayes.

zooko commented

2015-02-06 17:46:54 +00:00

Author

Owner

HoverHell: sorry about that. ☹ Attempting to fix it. Here's the comment that you tried to post that spambayes ate:

significant performance impact relative to other factors

I think, measuring it relative to other factors would require implementing it. I haven't gotten into the code yet, and I'm mostly suggesting it as a potentially-simple addition. Though it is possible I will get to experiment with this later.

HoverHell: sorry about that. ☹ Attempting to fix it. Here's the comment that you tried to post that spambayes ate: > > significant performance impact relative to other factors > > I think, measuring it relative to other factors would require implementing it. I haven't gotten into the code yet, and I'm mostly suggesting it as a potentially-simple addition. Though it is possible I will get to experiment with this later.

daira commented

2015-02-07 00:56:49 +00:00

Author

Owner

Technically it would require implementing it, but the implementation could be an easier hack such as commenting out code in twisted.conch (that wouldn't be suitable for a "real" implementation), for instance.

Technically it would require implementing it, but the implementation could be an easier hack such as commenting out code in `twisted.conch` (that wouldn't be suitable for a "real" implementation), for instance.

exarkun commented

2020-01-20 20:45:18 +00:00

Author

Owner

I think that null cipher SSH is poorly supported by SSH implementations. My recollection is that OpenSSH initially supported it for quite some time and at some point decided to drop it. Twisted Conch supported it at some point. I don't remember if that support went away or not.