Full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob
Find a file
2021-03-28 22:25:24 +02:00
.github document Cockroach driver name 2021-03-27 19:41:00 +01:00
cmd extend virtual folders support to all storage backends 2021-03-21 19:15:47 +01:00
common docs: add some notes about the new virtual folders support 2021-03-21 19:47:11 +01:00
config webdav: add prefix support 2021-03-07 17:10:45 +01:00
dataprovider webui: add responsive extension 2021-03-28 11:02:11 +02:00
docker back to development 2021-03-28 22:25:24 +02:00
docs document Cockroach driver name 2021-03-27 19:41:00 +01:00
examples convertusers: fix permissions 2021-03-27 19:18:01 +01:00
fail2ban proxy protocol: added an option to make the proxy header required 2020-02-29 00:02:06 +01:00
ftpd Windows: manually check if we can bind on the configured port/ports 2021-03-21 22:21:04 +01:00
httpclient httpclient: load CA certificates only when required 2021-03-10 21:45:48 +01:00
httpd OpenAPI: document that secrets are automatically encrypted before saving 2021-03-28 11:23:06 +02:00
httpdtest extend virtual folders support to all storage backends 2021-03-21 19:15:47 +01:00
init systemd unit: run as "sftpgo" system user 2020-09-25 18:23:04 +02:00
kms WebDAV: try to preserve the lock fs as much as possible 2021-03-27 19:10:27 +01:00
logger WebDAV: improve TLS certificate authentication 2021-03-01 19:28:11 +01:00
metrics WebDAV: improve TLS certificate authentication 2021-03-01 19:28:11 +01:00
pkgs back to development 2021-03-28 22:25:24 +02:00
service improve signals handling 2021-03-25 19:31:21 +01:00
sftpd external auth: allow to inspect and preserve an existing user 2021-03-26 15:19:01 +01:00
static webui: add responsive extension 2021-03-28 11:02:11 +02:00
telemetry WebDAV: improve TLS certificate authentication 2021-03-01 19:28:11 +01:00
templates webui: add responsive extension 2021-03-28 11:02:11 +02:00
utils external auth: allow to inspect and preserve an existing user 2021-03-26 15:19:01 +01:00
version back to development 2021-03-28 22:25:24 +02:00
vfs webui: add responsive extension 2021-03-28 11:02:11 +02:00
webdavd WebDAV: try to preserve the lock fs as much as possible 2021-03-27 19:10:27 +01:00
windows-installer rename default branch from master to main 2021-02-09 19:53:03 +01:00
.gitignore Update README add section for dataprovider init 2020-01-31 08:56:15 +01:00
.golangci.yml add more linters 2020-05-06 19:36:34 +02:00
Dockerfile use Go 1.16 for CI and Docker images 2021-02-21 12:01:37 +01:00
Dockerfile.alpine use Go 1.16 for CI and Docker images 2021-02-21 12:01:37 +01:00
go.mod OpenAPI: document that secrets are automatically encrypted before saving 2021-03-28 11:23:06 +02:00
go.sum OpenAPI: document that secrets are automatically encrypted before saving 2021-03-28 11:23:06 +02:00
LICENSE change license to AGPL-3 2021-02-26 19:47:48 +01:00
main.go rename default branch from master to main 2021-02-09 19:53:03 +01:00
README.md data provider: add CockroachDB support 2021-03-23 19:14:15 +01:00
SECURITY.md back to development 2020-10-11 09:29:17 +02:00
sftpgo.json webdav: add prefix support 2021-03-07 17:10:45 +01:00

SFTPGo

CI Status Code Coverage Go Report Card License: AGPL v3 Docker Pulls Mentioned in Awesome Go

Fully featured and highly configurable SFTP server with optional FTP/S and WebDAV support, written in Go. Several storage backends are supported: local filesystem, encrypted local filesystem, S3 (compatible) Object Storage, Google Cloud Storage, Azure Blob Storage, SFTP.

Features

  • SFTPGo uses virtual accounts stored inside a "data provider".
  • SQLite, MySQL, PostgreSQL, Bolt (key/value store in pure Go), CockroachDB and in-memory data providers are supported.
  • Each local account is chrooted in its home directory, for cloud-based accounts you can restrict access to a certain base path.
  • Public key and password authentication. Multiple public keys per user are supported.
  • SSH user certificate authentication.
  • Keyboard interactive authentication. You can easily setup a customizable multi-factor authentication.
  • Partial authentication. You can configure multi-step authentication requiring, for example, the user password after successful public key authentication.
  • Per user authentication methods. You can configure the allowed authentication methods for each user.
  • Custom authentication via external programs/HTTP API is supported.
  • Data At Rest Encryption is supported.
  • Dynamic user modification before login via external programs/HTTP API is supported.
  • Quota support: accounts can have individual quota expressed as max total size and/or max number of files.
  • Bandwidth throttling is supported, with distinct settings for upload and download.
  • Per user maximum concurrent sessions.
  • Per user and per directory permission management: list directory contents, upload, overwrite, download, delete, rename, create directories, create symlinks, change owner/group and mode, change access and modification times.
  • Per user files/folders ownership mapping: you can map all the users to the system account that runs SFTPGo (all platforms are supported) or you can run SFTPGo as root user and map each user or group of users to a different system account (*NIX only).
  • Per user IP filters are supported: login can be restricted to specific ranges of IP addresses or to a specific IP address.
  • Per user and per directory shell like patterns filters are supported: files can be allowed or denied based on shell like patterns.
  • Virtual folders are supported: directories outside the user home directory or based on a different storage provider can be exposed as virtual folders.
  • Configurable custom commands and/or HTTP notifications on file upload, download, pre-delete, delete, rename, on SSH commands and on user add, update and delete.
  • Automatically terminating idle connections.
  • Automatic blocklist management is supported using the built-in defender.
  • Atomic uploads are configurable.
  • Support for Git repositories over SSH.
  • SCP and rsync are supported.
  • FTP/S is supported. You can configure the FTP service to require TLS for both control and data connections.
  • WebDAV is supported.
  • Two-Way TLS authentication, aka TLS with client certificate authentication, is supported for REST API/Web Admin, FTPS and WebDAV over HTTPS.
  • Support for serving local filesystem, encrypted local filesystem, S3 Compatible Object Storage, Google Cloud Storage, Azure Blob Storage or other SFTP accounts over SFTP/SCP/FTP/WebDAV.
  • Per user protocols restrictions. You can configure the allowed protocols (SSH/FTP/WebDAV) for each user.
  • Prometheus metrics are exposed.
  • Support for HAProxy PROXY protocol: you can proxy and/or load balance the SFTP/SCP/FTP/WebDAV service without losing the information about the client's address.
  • REST API for users and folders management, backup, restore and real time reports of the active connections with possibility of forcibly closing a connection.
  • Web based administration interface to easily manage users, folders and connections.
  • Easy migration from Linux system user accounts.
  • Portable mode: a convenient way to share a single directory on demand.
  • SFTP subsystem mode: you can use SFTPGo as OpenSSH's SFTP subsystem.
  • Performance analysis using built-in profiler.
  • Configuration format is at your choice: JSON, TOML, YAML, HCL, envfile are supported.
  • Log files are accurate and they are saved in the easily parsable JSON format (more information).

Platforms

SFTPGo is developed and tested on Linux. After each commit, the code is automatically built and tested on Linux, macOS and Windows using a GitHub Action. The test cases are regularly manually executed and passed on FreeBSD. Other *BSD variants should work too.

Requirements

  • Go as build only dependency. We support the Go version(s) used in continuous integration workflows.
  • A suitable SQL server to use as data provider: PostgreSQL 9.4+ or MySQL 5.6+ or SQLite 3.x or CockroachDB stable.
  • The SQL server is optional: you can choose to use an embedded bolt database as key/value store or an in memory data provider.

Installation

Binary releases for Linux, macOS, and Windows are available. Please visit the releases page.

An official Docker image is available. Documentation is here.

Some Linux distro packages are available:

  • For Arch Linux via AUR:
    • sftpgo. This package follows stable releases. It requires git, gcc and go to build.
    • sftpgo-bin. This package follows stable releases downloading the prebuilt linux binary from GitHub. It does not require git, gcc and go to build.
    • sftpgo-git. This package builds and installs the latest git main branch. It requires git, gcc and go to build.
  • Deb and RPM packages are built after each commit and for each release.
  • For Ubuntu a PPA is available here.

You can easily test new features selecting a commit from the Actions page and downloading the matching build artifacts for Linux, macOS or Windows. GitHub stores artifacts for 90 days.

Alternately, you can build from source.

Configuration

A full explanation of all configuration methods can be found here.

Please make sure to initialize the data provider before running the daemon.

To start SFTPGo with the default settings, simply run:

sftpgo serve

Check out this documentation if you want to run SFTPGo as a service.

Data provider initialization and management

Before starting the SFTPGo server please ensure that the configured data provider is properly initialized/updated.

For PostgreSQL, MySQL and CockroachDB providers, you need to create the configured database. For SQLite, the configured database will be automatically created at startup. Memory and bolt data providers do not require an initialization but they could require an update to the existing data after upgrading SFTPGo.

SFTPGo will attempt to automatically detect if the data provider is initialized/updated and if not, will attempt to initialize/ update it on startup as needed.

Alternately, you can create/update the required data provider structures yourself using the initprovider command.

For example, you can simply execute the following command from the configuration directory:

sftpgo initprovider

Take a look at the CLI usage to learn how to specify a different configuration file:

sftpgo initprovider --help

You can disable automatic data provider checks/updates at startup by setting the update_mode configuration key to 1.

Upgrading

SFTPGo supports upgrading from the previous release branch to the current one. Some examples for supported upgrade paths are:

  • from 1.2.x to 2.0.x
  • from 2.0.x to 2.1.x and so on.

For supported upgrade paths, the data and schema are migrated automatically, alternately you can use the initprovider command.

So if, for example, you want to upgrade from a version before 1.2.x to 2.0.x, you must first install version 1.2.x, update the data provider and finally install the version 2.0.x. It is recommended to always install the latest available minor version, ie do not install 1.2.0 if 1.2.2 is available.

Loading data from a provider independent JSON dump is supported from the previous release branch to the current one too. After updating SFTPGo it is advisable to load the old dump and regenerate it from the new version.

Downgrading

If for some reason you want to downgrade SFTPGo, you may need to downgrade your data provider schema and data as well. You can use the revertprovider command for this task.

As for upgrading, SFTPGo supports downgrading from the previous release branch to the current one.

So, if you plan to downgrade from 2.0.x to 1.2.x, before uninstalling 2.0.x version, you can prepare your data provider executing the following command from the configuration directory:

sftpgo revertprovider --to-version 4

Take a look at the CLI usage to see the supported parameter for the --to-version argument and to learn how to specify a different configuration file:

sftpgo revertprovider --help

The revertprovider command is not supported for the memory provider.

Please note that we only support the current release branch and the current main branch, if you find a bug it is better to report it rather than downgrading to an older unsupported version.

Users and folders management

After starting SFTPGo you can manage users and folders using:

To support embedded data providers like bolt and SQLite we can't have a CLI that directly write users and folders to the data provider, we always have to use the REST API.

Full details for users, folders, admins and other resources are documented in the OpenAPI schema. If you want to render the schema without importing it manually, you can explore it on Stoplight.

Tutorials

Some step-to-step tutorials can be found inside the source tree howto directory.

Authentication options

External Authentication

Custom authentication methods can easily be added. SFTPGo supports external authentication modules, and writing a new backend can be as simple as a few lines of shell script. More information can be found here.

Keyboard Interactive Authentication

Keyboard interactive authentication is, in general, a series of questions asked by the server with responses provided by the client. This authentication method is typically used for multi-factor authentication.

More information can be found here.

Dynamic user creation or modification

A user can be created or modified by an external program just before the login. More information about this can be found here.

Custom Actions

SFTPGo allows to configure custom commands and/or HTTP notifications on file upload, download, delete, rename, on SSH commands and on user add, update and delete.

More information about custom actions can be found here.

Virtual folders

Directories outside the user home directory or based on a different storage provider can be exposed as virtual folders, more information here.

Other hooks

You can get notified as soon as a new connection is established using the Post-connect hook and after each login using the Post-login hook. You can use your own hook to check passwords.

Storage backends

S3 Compatible Object Storage backends

Each user can be mapped to the whole bucket or to a bucket virtual folder. This way, the mapped bucket/virtual folder is exposed over SFTP/SCP/FTP/WebDAV. More information about S3 integration can be found here.

Google Cloud Storage backend

Each user can be mapped with a Google Cloud Storage bucket or a bucket virtual folder. This way, the mapped bucket/virtual folder is exposed over SFTP/SCP/FTP/WebDAV. More information about Google Cloud Storage integration can be found here.

Azure Blob Storage backend

Each user can be mapped with an Azure Blob Storage container or a container virtual folder. This way, the mapped container/virtual folder is exposed over SFTP/SCP/FTP/WebDAV. More information about Azure Blob Storage integration can be found here.

SFTP backend

Each user can be mapped to another SFTP server account or a subfolder of it. More information can be found here.

Encrypted backend

Data at-rest encryption is supported via the cryptfs backend.

Other Storage backends

Adding new storage backends is quite easy:

  • implement the Fs interface.
  • update the user method GetFilesystem to return the new backend
  • update the web interface and the REST API CLI
  • add the flags for the new storage backed to the portable mode

Anyway, some backends require a pay per use account (or they offer free account for a limited time period only). To be able to add support for such backends or to review pull requests, please provide a test account. The test account must be available for enough time to be able to maintain the backend and do basic tests before each new release.

Brute force protection

The connection failed logs can be used for integration in tools such as Fail2ban. Example of jails and filters working with systemd/journald are available in fail2ban directory.

You can also use the built-in defender.

Account's configuration properties

Details information about account configuration properties can be found here.

Performance

SFTPGo can easily saturate a Gigabit connection on low end hardware with no special configuration, this is generally enough for most use cases.

More in-depth analysis of performance can be found here.

Release Cadence

SFTPGo releases are feature-driven, we don't have a fixed time based schedule. As a rough estimate, you can expect 1 or 2 new releases per year.

Acknowledgements

SFTPGo makes use of the third party libraries listed inside go.mod.

We are very grateful to all the people who contributed with ideas and/or pull requests.

Thank you ysura for granting me stable access to a test AWS S3 account.

Sponsors

I'd like to make SFTPGo into a sustainable long term project and your sponsorship will really help ❤️

Thank you to our sponsors!

segmed logo

License

GNU AGPLv3