SFTP maintenance operation

[p1ngouiin]

Dear developers,

Please be informed that tomorrow morning, we will be performing a scheduled maintenance on our SFTP service. The primary purpose of this maintenance is to enhance the security and stability of our file transfer operations. During this update, the access port for the SFTP service will be changed.

Key Details:

- Date of Maintenance: 2024-08-27 09:00:00 UTC+2 (Paris time)
- Time of Maintenance: at least 1 hour
- Service Impact: The SFTP service will be temporarily unavailable during the maintenance window.

What’s Changing:

- New SFTP Port: After the maintenance, a new port will be used to access the SFTP service (instead of 22, you will have to use 2022). This change is part of our efforts to provide a more secure and stable environment for file uploads.

Post-Maintenance Access:

- The old SFTP access will still be available for a limited time, but it will redirect users to a migration directory. This directory will contain a README file with instructions on how to update your SFTP client to use the new port.

New SFTP server information:

- SFTP Server address: Unchanged
- Port: `2022` (previously `22`)
- Username: Unchanged
- Password: Unchanged
- Private key: Unchanged (if using key-based authentication)

We apologize for any inconvenience this may cause and appreciate your understanding as we work to improve our service. If you have any questions or need assistance with the transition, please do not hesitate to contact our support team.

Thank you for your cooperation.

[nicotacotac]

Would it be possible to change the sftp password for our account by ourselves? That can also be security improvements to enable everyone to regularly update it

[p1ngouiin]

Would it be possible to change the sftp password for our account by ourselves? That can also be security improvements to enable everyone to regularly update it

It is advisable to eliminate the SFTP password and use simply the SSH public key. We do not intend to offer password reset. Passwords are generated automatically and securely, but I understand they are not intended to be remembered. You are already able to upload your SSH key and connect to SFTP with it. This is the favored method.

After the SFTP maintenance, adding or updating an SSH key will be instant (instead of 1-2 hours delayed).

- https://en.doc.boardgamearena.com/Conta ... Management
- https://studio.boardgamearena.com/controlpanel

[nicotacotac]

Thanks! I didn't think about it. Does it disable the password login then ?

[p1ngouiin]

Would it be possible to change the sftp password for our account by ourselves? That can also be security improvements to enable everyone to regularly update it

It is advisable to eliminate the SFTP password and use simply the SSH public key. We do not intend to offer password reset. Passwords are generated automatically and securely, but I understand they are not intended to be remembered. You are already able to upload your SSH key and connect to SFTP with it. This is the favored method.

After the SFTP maintenance, adding or updating an SSH key will be instant (instead of 1-2 hours delayed).

- https://en.doc.boardgamearena.com/Conta ... Management
- https://studio.boardgamearena.com/controlpanel

For security, this needs to disable the password. Does it do so?

If, for example, someone accidentally pastes their generated password into a public Discord / github repo / whatever, the password is now compromised. At minimum it would be crucial to allow the password to be disabled if reset is impossible for some reason.

Thanks! I didn't think about it. Does it disable the password login then ?

No, it doesn’t disable password authentication by default (just like connecting to a server using your SSH key doesn’t prevent password connection by default). But, if you know your password is compromised, we can disable password authentication. That’s not possible yet (and not sure it will be one day) to disable password authentication from the BGA interface. But I keep the idea in mind.

Edit: In theory, it should be possible for me, after the migration, to turn off password authentication if a key authorization is set. I'll look at that deeper after the maintenance.

[AxeCrazy]

when all is done, could you please add a message here?
SFTP seems to be on and off for a while now,
Don't know if its still maintainance or my settings

[p1ngouiin]

Hello.

The maintenance is over. Please now connects to the SFTP using the port `2022` (credentials/SSH key are unchanged).

[p1ngouiin]

We decided internally to delete password authentication when an SSH public key is uploaded. This change is not retroactive: password authentication remains possible if you do not re-upload your SSH public key.

In the long run, we will deactivate password authentication by default and allow just SSH authentication (ETA not yet determined).

[p1ngouiin]

Hello.

I just closed the old (s)FTP access. Previously, you could connect to the (s)FTP (by port '22'), but only had access to a migration directory with a README. This connection has now been terminated completely. If you have trouble connecting to SFTP, please migrate and use port '2022' instead (same credentials, new port).

Thanks for your comprehension.