Automating CrushFTP Upgrades and In-Place Updates

LIMEHAWK - Managed IT

Home>Incident Reports>Automating CrushFTP Upgrades and In-Place Updates

Summary

To streamline server maintenance, we built two bash scripts for CrushFTP management. The first automates in-place updates through the built-in API, ensuring servers stay patched with minimal downtime. The second handles major version upgrades (v10 to v11), migrating all critical settings, user data, SSH keys, jobs, and custom branding — turning a complex manual process into a single reliable command.

The challenge

Manually updating and upgrading CrushFTP servers is repetitive and error-prone. In-place updates mean logging into the admin console, clicking through prompts, waiting, verifying. Major version upgrades are worse: you're copying a dozen folders and config files by hand, uninstalling the old daemon, installing the new one, and hoping nothing got missed. Done across multiple environments, this is exactly the kind of task where one tired copy-paste turns into a 2 AM support ticket.

The ask was simple: make both operations automated, consistent, and safe enough to run on a cron schedule.

Solution: automation scripts

Two distinct bash scripts — one for minor in-place updates, one for the v10 to v11 major version migration. Different goals, different designs.

Script 1: automated in-place updates

This one leverages the CrushFTP HTTPS API to check for and apply pending updates. Designed to run as a cron job so servers stay current with security patches and bug fixes automatically. Every action writes to /var/log/crushftp_update.log for later auditing.

It hits /?command=checkForUpdate, parses the XML response, and only fires /?command=updateNow if an update is actually available — no unnecessary restarts, no noise when there's nothing to do.

Script 2: major version upgrade (V10 to v11)

The major upgrade is where manual work really bites. CrushFTP's data is scattered across a lot of folders — users, prefs.XML, SSH host keys, TempAccounts, Previews, logs, jobs (enterprise only), statsDB — and if you miss any of them, the new install comes up wrong in ways that aren't always obvious until a user tries to log in.

This script handles the whole thing: downloads the new version, extracts it next to the old install, copies everything that matters, preserves the custom web interface logo, uninstalls the old daemon, installs the new one.

Security considerations

The in-place update script needs an admin username and password to talk to the API. We've sanitized the version shown here for public view — in production, never hardcode credentials directly.

- use a secret store (HashiCorp Vault, AWS Secrets Manager, or environment variables injected at runtime) to supply the password
- lock down script permissions with chmod 700 so only the owner can read or execute
- license registration for the major upgrade is still a manual step after the script completes — that's intentional

Outcome

These scripts cut the time and effort to maintain CrushFTP infrastructure way down. What used to be a multi-step manual process is now a single reliable command that can be scheduled without worry.

- drastically reduced manual effort for updates and upgrades
- consistent application of updates across all environments
- minimizes risk of human error during migrations (the copy step is where people always miss something)
- cron-job compatibility means "set-and-forget" security patching

Need help with something like this? Contact us

• PC Replacement: Zero Data Loss User Profile Migration (Automation)

• Winget for RMM: Silent Software Deployment at Scale (Automation)

• Mass BIOS & Driver Updates: Dell Fleet Vulnerability Patching (Automation)