Re: [Proftpd-user] mod_sftp vs sshd performance

Hello Sergei,

which ciphers were used, when you use sshd and proftpd ?
You will see it on command line with scp/sftp -v

Be sure both connections use the same one.


On Wed, May 08, Sergei Gerasenko wrote:

> Also, for some reason I’m having trouble enabling tracing for the sftp traffic. The sftp log is empty. I’ve put this in my main config at the very beginning:
> 
> # (http://www.proftpd.org/docs/howto/Tracing.html)
> TraceLog                        /var/log/proftpd/sftp_trace.log
> Trace scp:20 sftp:20 ssh2:20
> 
> 
> Attaching my proftpd -V and sftp config
> 
> Compile-time Settings:
>   Version: 1.3.6 (stable)
>   Platform: LINUX [Linux 3.10.0-957.1.3.el7.x86_64 x86_64]
>   Built: Mon Oct 22 2018 18:48:06 UTC
>   Built With:
>     configure  '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--localstatedir=/var' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--libexecdir=/usr/libexec/proftpd' '--localstatedir=/run/proftpd' '--disable-strip' '--enable-ctrls' '--enable-dso' '--enable-facl' '--enable-ipv6' '--enable-memcache' '--enable-nls' '--enable-openssl' '--disable-pcre' '--disable-redis' '--disable-xattr' '--enable-shadow' '--enable-tests=nonetwork' '--with-libraries=/usr/lib64/mysql' '--with-includes=/usr/include/mysql' '--with-modules=mod_readme:mod_auth_pam:mod_tls' '--with-shared=mod_sql:mod_sql_passwd:mod_sql_mysql:mod_sql_postgres:mod_sql_sqlite:mod_quotatab:mod_quotatab_file:mod_quotatab_ldap:mod_quotatab_radius:mod_quotatab_sql:mod_ldap:mod_ban:mod_wrap:mod_ctrls_admin:mod_facl:mod_load:mod_vroot:mod_radius:mod_ratio:mod_rewrite:mod_site_misc:mod_exec:mod_shaper:mod_geoip:mod_wrap2:mod_wrap2_file:mod_wrap2_sql:mod_copy:mod_deflate:mod_ifversion:mod_qos:mod_sftp:mod_sftp_pam:mod_sftp_sql:mod_tls_shmcache:mod_tls_memcache:mod_ifsession' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1  -m64 -mtune=generic' 'LDFLAGS=-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld' 'CXXFLAGS=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1  -m64 -mtune=generic'
> 
>   CFLAGS: -g2 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1  -m64 -mtune=generic -Wall -fno-omit-frame-pointer -Werror=implicit-function-declaration
>   LDFLAGS: -L$(top_srcdir)/lib -Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -rdynamic -L/usr/lib64/mysql -L/usr/lib64/mysql -L/usr/lib64
>   LIBS: -lacl  -lssl -lcrypto -lcap  -lmemcached -lmemcachedutil  -lssl -lcrypto  -lpam -lsupp -lnsl -lresolv -lresolv -lcrypt -ldl 
> 
>   Files:
>     Configuration File:
>       /etc/proftpd.conf
>     Pid File:
>       /run/proftpd/proftpd.pid
>     Scoreboard File:
>       /run/proftpd/proftpd.scoreboard
>     Header Directory:
>       /usr/include/proftpd
>     Shared Module Directory:
>       /usr/libexec/proftpd
> 
>   Info:
>     + Max supported UID: 4294967295
>     + Max supported GID: 4294967295
> 
>   Features:
>     - Autoshadow support
>     + Controls support
>     + curses support
>     - Developer support
>     + DSO support
>     + IPv6 support
>     + Largefile support
>     - Lastlog support
>     + Memcache support
>     + ncursesw support
>     + NLS support
>     - Redis support
>     - Sodium support
>     + OpenSSL support (FIPS enabled)
>     - PCRE support
>     + POSIX ACL support
>     + Shadow file support
>     + Sendfile support
>     + Trace support
>     - xattr support
> 
>   Tunable Options:
>     PR_TUNABLE_BUFFER_SIZE = 1024
>     PR_TUNABLE_DEFAULT_RCVBUFSZ = 8192
>     PR_TUNABLE_DEFAULT_SNDBUFSZ = 8192
>     PR_TUNABLE_ENV_MAX = 2048
>     PR_TUNABLE_GLOBBING_MAX_MATCHES = 100000
>     PR_TUNABLE_GLOBBING_MAX_RECURSION = 8
>     PR_TUNABLE_HASH_TABLE_SIZE = 40
>     PR_TUNABLE_LOGIN_MAX = 256
>     PR_TUNABLE_NEW_POOL_SIZE = 512
>     PR_TUNABLE_PATH_MAX = 4096
>     PR_TUNABLE_SCOREBOARD_BUFFER_SIZE = 80
>     PR_TUNABLE_SCOREBOARD_SCRUB_TIMER = 30
>     PR_TUNABLE_SELECT_TIMEOUT = 30
>     PR_TUNABLE_TIMEOUTIDENT = 10
>     PR_TUNABLE_TIMEOUTIDLE = 600
>     PR_TUNABLE_TIMEOUTLINGER = 10
>     PR_TUNABLE_TIMEOUTLOGIN = 300
>     PR_TUNABLE_TIMEOUTNOXFER = 300
>     PR_TUNABLE_TIMEOUTSTALLED = 3600
>     PR_TUNABLE_XFER_SCOREBOARD_UPDATES = 10
> 
> Thanks again,
>   Sergei
> 
> P.S.: I noticed that forums.proftpd.org <http://forums.proftpd.org/> has an invalid SSL cert. Can we chip in to fix that or is it prohibitively expensive?
> 
> > On May 7, 2019, at 3:05 PM, Sergei Gerasenko <[email protected]> wrote:
> > 
> > Hi,
> > 
> > I’m running proftpd version 1.3.6. When comparing the sftp transfer speed between sshd and proftpd, I recently noticed that proftpd sftp transfers are half as fast. My test is:
> > 
> > 858M file
> > same machine
> > scp as the transfer client
> > via sshd is 9.2 seconds
> > via mod_sftp: 24 seconds
> > 
> > I’ve tried turning off compression and adjusting socket options but with practically no difference. My sftp config is basically this:
> > 
> > <VirtualHost ...>
> > ...
> > SFTPENgine on
> > SFTPCompression delayed
> > ...
> > </VirtualHost>
> > 
> > Should the transfer speeds be comparable? Both sshd and proftpd are on the same machine.
> > 
> > Thanks for any ideas,
> >   Sergei
> 


> _______________________________________________
> ProFTPD Users List   <[email protected]>
> Unsubscribe problems?
> http://www.proftpd.org/list-unsub.html


-- 
Gruß

  Dieter

--
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
From field.


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html