Can lftp read netrc for sftp-connections

Question

I am trying to create a script to upload some files to a server via SFTP. I can do that manually by opening an interactive lftp-session and providing username and password there. For the script, I would like to

• not hardcode credentials in the script (for obvious reasons)
• not mention them on the commandline (I want the command in my .bash_history, but of course not the credentials)
• have lftp read the credentials from .netrc or something similar

I cannot seem to get this working. My current workaround is a wrapper-script that parses the .netrc for the credentials and adds them to a lftp-script which I delete afterwards. This simulates the steps I perform manually, but seems like re-implementing existing functionality poorly. While this works, the question remains:

Can lftp read .netrc for SFTP-connections?

If so, are there special syntax-requirements if customs ports are part of the setup? I need to connect to sftp://username:password1@example.com:12322.

Answer 1

The best bet would be to use key pair to access the server as you do for ssh. Three steps:

1. Create a key pair (if you don't have yet):

   ssh-keygen -t rsa -C "" -f ~/.ssh/id_rsa
   

2. Copy public key to the server:

   ssh-copy-id user@example.com -p 12322
   

3. Connect to the server:

   lftp sftp://user@example.com:12322
   

If you will use some non-standard path for the key, note that you should add the key to ssh-agent or to your .ssh/config before!

Answer 2

According to the lftp man page, ~/.netrc is supported/used by lftp:

~/.netrc

The file is consulted to get default login and password to FTP server. Passwords are also searched here if an URL with user name but with no password is used.

Based on this reading, I suspect that your URL, using custom ports, should be fine.

Answer 3

You can store your credentials in ~/.netrc. The file should look like:

machine ftp.cluster.host.net (do not include 'sftp://' here)
login yournickname
password xFrPkIB8767

Then you can connect with

lftp sftp://yournickname@ftp.cluster.host.net/

The nickname is required, but the password is pulled from .netrc. Your terminal history is clean!

You can also directly pass a command to lftp:

lftp -c "open sftp://yournickname@ftp.cluster.host.net; ls"

Pretty usefull for scripts and bash aliases!

Answer 4

I can confirm that roneo.org's answer is right and TheStoryCoder's comment explaining how to specify the port also works.

I wanted a more secure login option that does not keep the credentials in a plain-text file like .netrc and ensures my traffic is encrypted.

If lftp let you explicitly call the .netrc file, you could just encrypt your .netrc file with gpg and pass it to lftp. Like you can with cURL. Unfortunately, you cannot.

What you can do though is create an encrypted ftp url string that contains all your connection info including your password and pass it to lftp.

Start by making a plain-text file containing a single string with the entire login, port and path to your server. Basically, what gets stored in your lftp bookmarks file if you use it (~/.local/share/lftp/bookmarks), only without the alias.

So, if your bookmarks file has:

myftpserver ftp://<user>:<pass>@ftp.mysite.com:10234/path/to/files/

You are just going to use:

ftp://<user>:<pass>@ftp.mysite.com:10234/path/to/files/

First, make yourself a blank text file:

touch ~/.lftprc

Use a text editor to add that ftp url from your bookmarks file so you keep your password out of your bash history:

vi ~/.lftprc

If you never setup gpg, do that now:

gpg --full-generate-key

Then, encrypt that file with gpg:

gpg -r <GPG USER ID/EMAIL> -e ~/.lftprc

The file then becomes ~/.lftprc.gpg. Be sure to delete the file you made:

rm ~/.lftprc

Now you have your entire login url in basically an encrypted string that you can call using Bash and gpg:

lftp $( gpg --batch -q -d ~/.bookmark.gpg )

You can then turn this into an alias:

alias lftps='lftp $( gpg --batch -q -d ~/.bookmark.gpg )'

I chose lftps because it seemed cool, but you can do whatever you want:

HOSTNAME:~ # lftps
cd ok, cwd=/path/to/files                                                                  
lftp <user>@ftp.mysite.com:/path/to/files>

My ftp server supports Explicit TLS over FTP so for the secure transfers, in my .lftp.conf I have:

set ssl-allow true
set ssl:ca-file "/var/lib/ca-certificates/ca-bundle.pem"
set ftp:ssl-force true

So, after all that I wonder how lftp passes the user password to the server and if you can sniff that out...