cPanel ProFTPD SFTP Subsystem Hardening: Chroot Jails, Ed25519 Keys and Brute-Force Defense

Running legacy FTP or even plain FTPS on multi-tenant cPanel and WHM servers introduces administrative friction: firewall port ranges (passive ports 49152–65535) frequently clash with corporate NATs across Pakistani ISPs such as PTCL, Nayatel, and StormFiber, while credential sniffing remains a persistent risk.

By switching to ProFTPD with mod_sftp, web hosting administrators can provide clients with true SSH File Transfer Protocol (SFTP) running over a single, secure TCP port without granting shell access (/bin/bash or /bin/sh). More importantly, isolating tenant access using hardened chroot jails and disabling obsolete RSA 1024-bit ciphers in favor of modern Ed25519 and ChaCha20-Poly1305 protects production servers from credential stuffing and lateral privilege escalation.

Deploying hardened SFTP infrastructure on high-bandwidth Dedicated Servers and Dedicated Servers in Pakistan ensures secure file pipelines capable of transferring multi-gigabyte client databases and media assets at wire speed.

---

Why ProFTPD mod_sftp Outperforms OpenSSH Subsystem in cPanel

Standard Linux OpenSSH servers (sshd) can serve SFTP via Subsystem sftp /usr/libexec/openssh/sftp-server. However, in a cPanel environment, binding clients to OpenSSH creates two severe operational hurdles:

1. Shell Security Risk: Providing SFTP credentials often necessitates shell access accounts, risking shell escape or cron injection if permissions are misconfigured.
2. Quota and Virtual User Sync: OpenSSH does not natively integrate with cPanel’s virtual FTP account database (/etc/proftpd/passwd.vhosts), forcing admins to manage POSIX system users manually.

ProFTPD’s mod_sftp operates as a native SSH2 engine that directly authenticates against cPanel’s virtual FTP accounts, enforces cPanel disk quotas, locks users strictly inside their public_html or document root directory, and operates on an independent custom port (e.g., port 2222) leaving OpenSSH (port 22) reserved exclusively for system administrators.

+-------------------------------------------------------------+
|             Client SFTP Connection (Port 2222)              |
+------------------------------+------------------------------+
                               |
                               v
+-------------------------------------------------------------+
|           ProFTPD mod_sftp Engine (cPanel Daemon)           |
|                                                             |
|   1. Authenticates against /etc/proftpd/passwd.vhosts        |
|   2. Validates Ed25519 Host Key                             |
|   3. Enforces Strict Chroot Jail to /home/user/public_html  |
|   4. Zero Shell Access Granted (/bin/false)                 |
+------------------------------+------------------------------+
                               |
                               v
+-------------------------------------------------------------+
|               Isolated File System Operations               |
+-------------------------------------------------------------+

For administrators comparing FTP daemon architectures, explore our companion breakdown on cPanel Pure-FTPd TLS and Passive Port Range Hardening and our operational firewall guide on CSF Firewall LFD Brute Force Hardening.

---

Step 1: Selecting ProFTPD in WHM and Verifying mod_sftp

1. Log in to WHM as root.
2. Navigate to Service Configuration >> FTP Server Selection.
3. Select ProFTPD and click Save. cPanel will compile and start the ProFTPD daemon.

Verify on the command line that the binary was compiled with mod_sftp:

# Check loaded ProFTPD modules
proftpd -vv | grep -i sftp

You should see mod_sftp/1.0.x compiled into the server.

---

Step 2: Generating Modern Ed25519 and RSA 4096-bit Host Keys

By default, older ProFTPD deployments rely on legacy 1024-bit or 2048-bit RSA keys. To comply with modern cryptographic standards, generate dedicated host keys for mod_sftp:

# Create dedicated directory for SFTP host keys
mkdir -p /etc/proftpd/sftp_keys
chmod 0700 /etc/proftpd/sftp_keys

# Generate modern Ed25519 host key
ssh-keygen -t ed25519 -f /etc/proftpd/sftp_keys/sftp_host_ed25519_key -N ""

# Generate RSA 4096-bit fallback key for legacy clients
ssh-keygen -t rsa -b 4096 -f /etc/proftpd/sftp_keys/sftp_host_rsa_key -N ""

# Lock down private key permissions
chmod 0600 /etc/proftpd/sftp_keys/*_key
chown -R root:root /etc/proftpd/sftp_keys

---

Step 3: Hardening ProFTPD Configuration with sftp.conf

In cPanel, do not modify /etc/proftpd.conf directly, as cPanel updates will overwrite your modifications. Instead, use cPanel’s custom configuration include file /etc/proftpd.conf.local or drop a dedicated configuration file into /etc/proftpd/conf.d/sftp.conf.

Create /etc/proftpd/conf.d/sftp.conf:

<IfModule mod_sftp.c>
    # Bind SFTP service to dedicated port 2222
    <VirtualHost 0.0.0.0>
        ServerName "Nextgen High-Security SFTP Engine"
        Port 2222
        
        SFTPEngine on
        SFTPLog /var/log/proftpd/sftp.log

        # Host Keys (Ed25519 prioritized over RSA)
        SFTPHostKey /etc/proftpd/sftp_keys/sftp_host_ed25519_key
        SFTPHostKey /etc/proftpd/sftp_keys/sftp_host_rsa_key

        # Restrict ciphers to modern AEAD algorithms
        SFTPCiphers [email protected] [email protected] [email protected] aes256-ctr aes192-ctr aes128-ctr

        # Restrict Key Exchange to secure curves and DH groups
        SFTPKeyExchanges curve25519-sha256 [email protected] diffie-hellman-group16-sha512 diffie-hellman-group18-sha512

        # Restrict MAC algorithms (for non-GCM ciphers)
        SFTPDigests hmac-sha2-512[email protected] hmac-sha2-256[email protected] umac-128[email protected]

        # Authentication: Virtual cPanel user passwords and public keys
        SFTPAuthMethods password publickey
        
        # Absolute Chroot Jail: User cannot escape their assigned home directory
        DefaultRoot ~
        
        # Max Login Attempts before TCP socket disconnect
        SFTPMaxUserAttempts 3

        # Zero shell access enforced
        RequireValidShell off
    </VirtualHost>
</IfModule>

Add the include directive to /etc/proftpd.conf.local:

Include /etc/proftpd/conf.d/sftp.conf

Run syntax verification and rebuild the cPanel FTP configuration:

# Verify configuration syntax
proftpd -t -c /etc/proftpd.conf

# Restart the service via cPanel manager
/scripts/restartsrv_ftpserver

---

Step 4: Configuring CSF Firewall and LFD Brute-Force Shielding

Now open TCP port 2222 in your ConfigServer Security & Firewall (CSF) and configure Login Failure Daemon (LFD) to catch and ban brute-force attacks against the SFTP port.

Edit /etc/csf/csf.conf:

# Add 2222 to incoming TCP ports
TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,2222,..."

Next, configure LFD to parse /var/log/proftpd/sftp.log. Edit /etc/csf/csf.conf:

# ProFTPD SFTP Failure Trigger
FTPD_LOG = "/var/log/proftpd/sftp.log"
LF_FTPD = "5"
LF_FTPD_PERM = "3600"

Create a custom LFD regex rule in /etc/csf/regex.custom.pm to parse mod_sftp failures:

# Custom regex for ProFTPD mod_sftp authentication failures
if (($globlogs{FTPD_LOG}{$lgfile}) and ($line =~ /mod_sftp.*authentication for (.*) failed: (.*) from (\d+\.\d+\.\d+\.\d+)/)) {
    my $user = $1;
    my $ip = $3;
    return ("Failed SFTP login from $ip ($user)",$ip,"mod_sftp","5","2222","3600");
}

Reload CSF and LFD:

csf -r

For advanced firewall optimization guidelines, review Configure CSF Firewall on VPS for Low Latency.

---

Step 5: Testing and Validating SFTP Connection

Verify the hardened SFTP daemon using sftp with verbose debugging flags:

# Connect using sftp client specifying custom port 2222
sftp -P 2222 -v [email protected]

Observe the debug logs confirming the algorithm negotiation:

debug1: kex: algorithm: curve25519-sha256
debug1: Host key: ED25519 SHA256:d8K0jF...
debug1: cipher: [email protected]
debug1: Authentication succeeded (password).
Connected to server.yourdomain.pk.
sftp> pwd
Remote working directory: /
sftp> cd ..
sftp> pwd
Remote working directory: /

Notice that cd .. cannot traverse above / (the tenant’s jailed root), ensuring total data isolation across all accounts on the server.

---