cPanel ProFTPD SFTP Subsystem Hardening: Chroot Jails, Ed25519 Keys and Brute-Force Defense

Running legacy FTP or even plain FTPS on multi-tenant cPanel and WHM servers introduces administrative friction: firewall port ranges (passive ports 49152–65535) frequently clash with corporate NATs across Pakistani ISPs such as PTCL, Nayatel, and StormFiber, while credential sniffing remains a persistent risk.

By switching to ProFTPD with mod_sftp, web hosting administrators can provide clients with true SSH File Transfer Protocol (SFTP) running over a single, secure TCP port without granting shell access (/bin/bash or /bin/sh). More importantly, isolating tenant access using hardened chroot jails and disabling obsolete RSA 1024-bit ciphers in favor of modern Ed25519 and ChaCha20-Poly1305 protects production servers from credential stuffing and lateral privilege escalation.

Deploying hardened SFTP infrastructure on high-bandwidth Dedicated Servers and Dedicated Servers in Pakistan ensures secure file pipelines capable of transferring multi-gigabyte client databases and media assets at wire speed.

---

Why ProFTPD mod_sftp Outperforms OpenSSH Subsystem in cPanel

Standard Linux OpenSSH servers (sshd) can serve SFTP via Subsystem sftp /usr/libexec/openssh/sftp-server. However, in a cPanel environment, binding clients to OpenSSH creates two severe operational hurdles:

1. Shell Security Risk: Providing SFTP credentials often necessitates shell access accounts, risking shell escape or cron injection if permissions are misconfigured.
2. Quota and Virtual User Sync: OpenSSH does not natively integrate with cPanel’s virtual FTP account database (/etc/proftpd/passwd.vhosts), forcing admins to manage POSIX system users manually.

ProFTPD’s mod_sftp operates as a native SSH2 engine that directly authenticates against cPanel’s virtual FTP accounts, enforces cPanel disk quotas, locks users strictly inside their public_html or document root directory, and operates on an independent custom port (e.g., port 2222) leaving OpenSSH (port 22) reserved exclusively for system administrators.

For administrators comparing FTP daemon architectures, explore our companion breakdown on cPanel Pure-FTPd TLS and Passive Port Range Hardening and our operational firewall guide on CSF Firewall LFD Brute Force Hardening.

---

Step 1: Selecting ProFTPD in WHM and Verifying mod_sftp

1. Log in to WHM as root.
2. Navigate to Service Configuration >> FTP Server Selection.
3. Select ProFTPD and click Save. cPanel will compile and start the ProFTPD daemon.

Verify on the command line that the binary was compiled with mod_sftp:

# Check loaded ProFTPD modules
proftpd -vv | grep -i sftp

You should see mod_sftp/1.0.x compiled into the server.

---

Step 2: Generating Modern Ed25519 and RSA 4096-bit Host Keys

By default, older ProFTPD deployments rely on legacy 1024-bit or 2048-bit RSA keys. To comply with modern cryptographic standards, generate dedicated host keys for mod_sftp:

# Create dedicated directory for SFTP host keys
mkdir -p /etc/proftpd/sftp_keys
chmod 0700 /etc/proftpd/sftp_keys

# Generate modern Ed25519 host key
ssh-keygen -t ed25519 -f /etc/proftpd/sftp_keys/sftp_host_ed25519_key -N ""

# Generate RSA 4096-bit fallback key for legacy clients
ssh-keygen -t rsa -b 4096 -f /etc/proftpd/sftp_keys/sftp_host_rsa_key -N ""

# Lock down private key permissions
chmod 0600 /etc/proftpd/sftp_keys/*_key
chown -R root:root /etc/proftpd/sftp_keys

---

Step 3: Hardening ProFTPD Configuration with sftp.conf

In cPanel, do not modify /etc/proftpd.conf directly, as cPanel updates will overwrite your modifications. Instead, use cPanel’s custom configuration include file /etc/proftpd.conf.local or drop a dedicated configuration file into /etc/proftpd/conf.d/sftp.conf.

Create /etc/proftpd/conf.d/sftp.conf:

<IfModule mod_sftp.c>
    # Bind SFTP service to dedicated port 2222
    <VirtualHost 0.0.0.0>
        ServerName "Nextgen High-Security SFTP Engine"
        Port 2222
        
        SFTPEngine on
        SFTPLog /var/log/proftpd/sftp.log

        # Host Keys (Ed25519 prioritized over RSA)
        SFTPHostKey /etc/proftpd/sftp_keys/sftp_host_ed25519_key
        SFTPHostKey /etc/proftpd/sftp_keys/sftp_host_rsa_key

        # Restrict ciphers to modern AEAD algorithms
        SFTPCiphers [email protected] [email protected] [email protected] aes256-ctr aes192-ctr aes128-ctr

        # Restrict Key Exchange to secure curves and DH groups
        SFTPKeyExchanges curve25519-sha256 [email protected] diffie-hellman-group16-sha512 diffie-hellman-group18-sha512

        # Restrict MAC algorithms (for non-GCM ciphers)
        SFTPDigests hmac-sha2-512[email protected] hmac-sha2-256[email protected] umac-128[email protected]

        # Authentication: Virtual cPanel user passwords and public keys
        SFTPAuthMethods password publickey
        
        # Absolute Chroot Jail: User cannot escape their assigned home directory
        DefaultRoot ~
        
        # Max Login Attempts before TCP socket disconnect
        SFTPMaxUserAttempts 3

        # Zero shell access enforced
        RequireValidShell off
    </VirtualHost>
</IfModule>

Add the include directive to /etc/proftpd.conf.local:

Include /etc/proftpd/conf.d/sftp.conf

Run syntax verification and rebuild the cPanel FTP configuration:

# Verify configuration syntax
proftpd -t -c /etc/proftpd.conf

# Restart the service via cPanel manager
/scripts/restartsrv_ftpserver

---

Step 4: Configuring CSF Firewall and LFD Brute-Force Shielding

Now open TCP port 2222 in your ConfigServer Security & Firewall (CSF) and configure Login Failure Daemon (LFD) to catch and ban brute-force attacks against the SFTP port.

Edit /etc/csf/csf.conf:

# Add 2222 to incoming TCP ports
TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,2222,..."

Next, configure LFD to parse /var/log/proftpd/sftp.log. Edit /etc/csf/csf.conf:

# ProFTPD SFTP Failure Trigger
FTPD_LOG = "/var/log/proftpd/sftp.log"
LF_FTPD = "5"
LF_FTPD_PERM = "3600"

Create a custom LFD regex rule in /etc/csf/regex.custom.pm to parse mod_sftp failures:

# Custom regex for ProFTPD mod_sftp authentication failures
if (($globlogs{FTPD_LOG}{$lgfile}) and ($line =~ /mod_sftp.*authentication for (.*) failed: (.*) from (\d+\.\d+\.\d+\.\d+)/)) {
    my $user = $1;
    my $ip = $3;
    return ("Failed SFTP login from $ip ($user)",$ip,"mod_sftp","5","2222","3600");
}

Reload CSF and LFD:

csf -r

For advanced firewall optimization guidelines, review Configure CSF Firewall on VPS for Low Latency.

---

Step 5: Testing and Validating SFTP Connection

Verify the hardened SFTP daemon using sftp with verbose debugging flags:

# Connect using sftp client specifying custom port 2222
sftp -P 2222 -v [email protected]

Observe the debug logs confirming the algorithm negotiation:

debug1: kex: algorithm: curve25519-sha256
debug1: Host key: ED25519 SHA256:d8K0jF...
debug1: cipher: [email protected]
debug1: Authentication succeeded (password).
Connected to server.yourdomain.pk.
sftp> pwd
Remote working directory: /
sftp> cd ..
sftp> pwd
Remote working directory: /

Notice that cd .. cannot traverse above / (the tenant’s jailed root), ensuring total data isolation across all accounts on the server.

---