TMS Kela SFTP
Related documents: Instance documentation: tms-backend-1b-nightly (https://app.clickup.com/2496230/docs/2c5q6-69975/2c5q6-216241)
Summary
Kela has set up two SFTP servers for us, one for testing and one for production. We are using public-private key files for authentication. The key files do not have password encryption. These key files are stored in tms-backend-1b-nightly.
| Environment Name | Test | Production |
|---|---|---|
| IP address (kela) | 91.223.107.119 | 91.223.107.113 |
| DNS | ftp2.kela.fi | ftp.kela.fi |
| Username | te4073 | tu4073 |
| Port | 22 | 22 |
Nightly
In nightly, the private key can be found in the instance tms-backend-1b-nightly. The key's location is /etc/tms-fleet/. The file is named adi_kela_sftp_ed25519. This file is not currently tracked in ci-bot or any Ansible scripts.
If the file needs to be updated or is missing, you can copy the new file from your local onto the server like so:
gcloud compute scp [source] [destination:path] --project my-gcp-project
Example:
gcloud compute scp adi_kela_sftp_ed25519 tms-backend-1b-nightly:~ --project att-nightly
The path :~ means to the home directory of the user you are connecting as.
Production
In production, the private key is stored in the new stable vault. the tms-cc machines automatically use the SFTP key when they need to.
Re-approving SFTP fingerprint/connection
If Kela requests that we approve the new SSH RSA server key, we can approve the new fingerprint like so:
1. Do these for each tms-confidential instance:
1. Copy the production private SSH key to the instance
2. Give the production private ssh key the correct permissions so you don't get the "WARNING UNPROTECTED PRIVATE KEY FILE!" error:
1. chmod 600 adi_kela_sftp_ed25519_prod
3. Initiate a connection to the Kela ftp-server:
1. sftp -i adi_kela_sftp_ed25519_prod tu4073@ftp.kela.fi
1. Approve the fingerprint
4. Lastly, delete the production private key from the instance:
1. rm -f adi_kela_sftp_ed25519_prod
sftp -i adi_kela_sftp_ed25519_prod tu4073@ftp.kela.fi
The authenticity of host 'ftp.kela.fi (91.223.107.113)' can't be established.
RSA key fingerprint is SHA256:gZ8...<hidden-by-miro>...X+XD4.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'ftp.kela.fi' (RSA) to the list of known hosts.Local testing
For local testing, we have produced a ProFTPD docker container that accepts public-private keys.
Usage
Create the docker image:
docker build -t proftpd_nightly
Create the volume, if necessary:
docker volume create --name proftpd_data_nightly
Create the docker container:
docker run -d -v proftpd_data_nightly:/kela_data --name proftpd_nightly proftpd_nightly
Explanation:
docker run -d(etached mode) -v(olume) docker_volume_name:docker_container_directory_name --name(of the container) docker_image