Problem/Motivation

Update manager allows only FTP connection to install new modules at /admin/modules/install.
FTP connections are insecure, and are abandoned by growing number of hosting providers in favor of sFTP

Proposed resolution

TBD

Remaining tasks

Agree on PHP extension / PEAR package / PHP library / interface that can handle sFTP connection management.
Update manager should check if the selected extension is installed on server, and offer sFTP connection in addition to FTP one.
If extension is not available, update manager should issue a warning.

User interface changes

Module installer screen should be modified

API changes

None

Data model changes

TBD

Comments

Jamie Holly’s picture

Jamie Holly CreditAttribution: Jamie Holly commented

The File API already handles SSH, so incorporating this shouldn't be to hard. The only problem I see is that the SSH API requires the SSH2 PECL extension, which might not be available on a lot of hosts. OTOH it would be a simple matter to check if the extension exists and offer SFTP as an option.

bfroehle’s picture

bfroehle CreditAttribution: bfroehle commented
Issue tags: +Update manager

intoxination is correct that you can do the updates if you have SSH access to your server, and if the SSH2 PHP extension is installed. It might be possible to modify the SSH code to actually use SFTP commands, but this would still require you have the SSH2 PHP extension be installed.

dww’s picture

dww
we/he/they
CreditAttribution: dww commented
Version: 7.0 » 8.x-dev

For core, this needs to happen in D8 (unless Drieschick want to allow backporting this).

In theory, something like http://drupal.org/project/update_advanced (or a separate stand-alone project) could do this in D7 contrib thanks to #609772: Impossible to extend the FileTransfer class system in contrib

Gabo11’s picture

Gabo11 CreditAttribution: Gabo11 commented

Hi!

Did someone find a good solution for add SFTP connection to the automatic modules update for D7?

(Home » Administration » Reports » Available updates)

Thanks!

allenshorter’s picture

allenshorter CreditAttribution: allenshorter commented

I am also interested if someone found a solution to allow SFTP for the Available updates page.

Gabo11’s picture

Gabo11 CreditAttribution: Gabo11 commented
Category: feature » support
Priority: Major » Critical
Gabo11’s picture

Gabo11 CreditAttribution: Gabo11 commented
Version: 8.x-dev » 7.x-dev
Category: support » feature
Priority: Critical » Major
ParisLiakos’s picture

ParisLiakos CreditAttribution: ParisLiakos commented
Version: 7.x-dev » 9.x-dev

+1 on the servers that kill ftp;) ftp is evil..
That said, i cant see this going in d7 and probably is too late for d8 as well..we are in feature freeze..so assigning on 9.x

Gabo11’s picture

Gabo11 CreditAttribution: Gabo11 commented
Version: 9.x-dev » 7.x-dev

I still need it on D7! Don't run too much rootatwc! :D

marcingy’s picture

marcingy CreditAttribution: marcingy commented
Version: 7.x-dev » 9.x-dev

This needs to go into drupal 9 first and then be backported, please do not change the status back to d7.

Gabo11’s picture

Gabo11 CreditAttribution: Gabo11 commented

Ook... that means that i'll have to wait 2 years before i get some answer!
And in these 2 years i will have to keep taking care of the updates for all my customers!

That doesn't sound really good!

ParisLiakos’s picture

ParisLiakos CreditAttribution: ParisLiakos commented

Gabo11: you can use drush..it is way faster than transferring files through (s)ftp :)

Gabo11’s picture

Gabo11 CreditAttribution: Gabo11 commented

Thanks rootatwc! I'll try it!
Have nice weekend!

catch’s picture

catch
he/him
Primary language English
CreditAttribution: catch commented
Version: 9.x-dev » 8.1.x-dev
Issue summary: View changes

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.0-beta1 was released on March 2, 2016, which means new developments and disruptive changes should now be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

valthebald’s picture

valthebald
Location Sofia
CreditAttribution: valthebald as a volunteer commented
Issue summary: View changes
Issue tags: +neworleans2016, +Triaged for D8 major current state

The issue is still there, and I haven't found any duplicate issue in the core queue.
Since the change doesn't break the BC, it can be part of 8.x (no need to postpone until 9.x as suggested in previous comments)

xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm at Acquia commented

Thanks @valthebald for triaging! Updating issue credit.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.0-beta1 was released on August 3, 2016, which means new developments and disruptive changes should now be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.0-alpha1 will be released the week of January 30, 2017, which means new developments and disruptive changes should now be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
CreditAttribution: alexpott at Chapter Three commented
Priority: Major » Normal
Related issues: +#2367319: Implement automatic background updates for highly critical security issues

Discussed with @catch, @cilefen, @cottser, @laurii, and @xjm. We decided that this is not a major task because there is a secure alternative. The upload module (with the right PHP extensions) supports SSH.

It'd be great if people who are interested in this issue can help implement the ideas on #2367319: Implement automatic background updates for highly critical security issues

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.0-alpha1 will be released the week of July 31, 2017, which means new developments and disruptive changes should now be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm at Acquia commented
Issue tags: -Triaged for D8 major current state
dww’s picture

dww
we/he/they
CreditAttribution: dww at TEN7 commented
Status: Active » Closed (won't fix)

Given that no one has moved this forward in at least 5 years, and that auto updates are going to be added to core in the (hopefully) near future, and that new features like this aren’t going to be added to the Update Manager at this point, I believe it’s safe to say this is never going to happen.

Thanks / sorry,
-Derek

Graham Leach’s picture

Graham Leach CreditAttribution: Graham Leach commented

...cue sound of an empty tin can being kicked down an increasingly lonely road...