3

I would like to write things like this in /etc/apt/sources.list:

deb sftp://someuser@some.server.org/path other stuff

When I try this, apt-get complains that there is no sftp method for apt:

# apt-get update
E: The method driver /usr/lib/apt/methods/sftp could not be found.

Has anyone written a patch to add the sftp method for apt? All I could find in Google was this spec for Ubuntu.

Thanks for your help.

edit: I forgot to mention that I currently use the ssh method, and it works fine. The reason why I'm looking for an sftp method is that I want to setup the repository in a chrooted environment on the server, for more security. I find it difficult to setup and maintain a chrooted environment usable with ssh (because you need binaries and their dependencies inside the chrooted environment, and you need to maintain those in case they need security updates), as opposed to a chrooted environment for sftp (simply using the appropriate sshd_config options).

MiniQuark
  • 3,875
  • 2
  • 21
  • 23

2 Answers2

1

This line will need to be in your /etc/apt/sources.list

deb ssh://user@packages.example.com /path/to/packages/on_the_server/

You'll probably want to setup auto key login and things of that nature. You'll also need to mirror the packages down to a server you control in order to install them this way. Because you'll need an account on the server.

David Rickman
  • 3,320
  • 18
  • 16
  • Oops, reading your answer, I realize that I probably wasn't clear enough in my question. I'll fix this in an edit. – MiniQuark Mar 08 '10 at 15:22
1

I'm not sure whether you want a secure file transfer for keeping the packages themselves safe, in which case I'd suggest using dpkg-sig, and a non-encrpyted transport such as a chroot'd http server of your preference.

Or using apt-transport-https if you want a secure authentication to a SSL enabled web server, which you can configure to run in a chroot'd environment, with or without user authentication (e.g. .htaccess for simple Apache access control).

Since I'm not familiar with your Use Case for an authenticated secure apt server, I may be missing some aspect of your situation.

mctylr
  • 863
  • 4
  • 9
  • Thanks for your answer. I am trying to protect private packages stored in the repository (this is why I do not use http), and also trying to protect my server from further intrusion, if a hacker gains access to the repository (this is why I would like a chroot'd environment). apt-transport-https sounds good, but I read that there is no way to configure it to check the server certificate, and from what I read authentication is a problem (you need the password in sources.list). I may be wrong on this, and if I am, then https is the way to go. – MiniQuark Mar 09 '10 at 17:02