beenull/sftpgo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
sftpgo/sftpgo.json

196 lines
4.2 KiB
JSON
Raw Normal View History

first version
2019-07-20 10:26:52 +00:00
{
refactoring: add common package The common package defines the interfaces that a protocol must implement and contain code that can be shared among supported protocols. This way should be easier to support new protocols
2020-07-24 21:39:38 +00:00
"common": {
Support multiple private (host) keys With this patch, one can configure one or more private (host) keys in the configuration file. I made it a nested struct, so we can add more options later. Eg. host certificates might be a useful addition if I can figure out how this is done in golang's crypto/ssh... Signed-off-by: Jo Vandeginste <Jo.Vandeginste@kuleuven.be>
2019-08-01 07:42:15 +00:00
"idle_timeout": 15,
add support for atomic upload Atomic uploads are now configurable. The default upload mode remains non atomic
2019-08-04 07:37:58 +00:00
"upload_mode": 0,
Support multiple private (host) keys With this patch, one can configure one or more private (host) keys in the configuration file. I made it a nested struct, so we can add more options later. Eg. host certificates might be a useful addition if I can figure out how this is done in golang's crypto/ssh... Signed-off-by: Jo Vandeginste <Jo.Vandeginste@kuleuven.be>
2019-08-01 07:42:15 +00:00
"actions": {
"execute_on": [],
actions: add a generic hook to define external commands and HTTP URL We can only define a single hook now and it can be an HTTP notification or an external command, not both
2020-05-24 13:29:39 +00:00
"hook": ""
Improve documentation
2019-08-01 13:39:30 +00:00
},
refactoring: add common package The common package defines the interfaces that a protocol must implement and contain code that can be shared among supported protocols. This way should be easier to support new protocols
2020-07-24 21:39:38 +00:00
"setstat_mode": 0,
"proxy_protocol": 0,
add post connect hook Fixes #144
2020-07-30 20:33:49 +00:00
"proxy_allowed": [],
add support for limiting max concurrent client connections
2020-12-15 18:29:30 +00:00
"post_connect_hook": "",
add support for a basic built-in defender It can help to prevent DoS and brute force password guessing
2021-01-02 13:05:09 +00:00
"max_total_connections": 0,
"defender": {
"enabled": false,
"ban_time": 30,
"ban_time_increment": 50,
"threshold": 15,
"score_invalid": 2,
"score_valid": 1,
"observation_time": 30,
"entries_soft_limit": 100,
"entries_hard_limit": 150,
"safelist_file": "",
"blocklist_file": ""
}
refactoring: add common package The common package defines the interfaces that a protocol must implement and contain code that can be shared among supported protocols. This way should be easier to support new protocols
2020-07-24 21:39:38 +00:00
},
"sftpd": {
add support for multiple bindings Fixes #253
2020-12-23 15:12:30 +00:00
"bindings": [
{
"port": 2022,
"address": "",
"apply_proxy_config": true
}
],
fix default config file restore a setting changed for a local test
2020-10-31 10:34:50 +00:00
"max_auth_tries": 0,
refactoring: add common package The common package defines the interfaces that a protocol must implement and contain code that can be shared among supported protocols. This way should be easier to support new protocols
2020-07-24 21:39:38 +00:00
"banner": "",
sftpd: deprecate keys and add a new host_keys config param host_key defines the private host keys as plain list of strings. Remove the other deprecated config params from the default config too. Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2020-05-16 21:26:44 +00:00
"host_keys": [],
sftpd: add configuration options for allowed ciphers, MACs and KEX algorithms add support for login banner too Fixes #32
2019-09-03 10:08:09 +00:00
"kex_algorithms": [],
"ciphers": [],
"macs": [],
add test case for expired SSH certificate Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2020-05-15 21:23:49 +00:00
"trusted_user_ca_keys": [],
sftpd: add support for chmod/chown added matching permissions too and a new setting "setstat_mode". Setting setstat_mode to 1 you can keep the previous behaviour that silently ignore setstat requests
2019-11-15 11:15:07 +00:00
"login_banner_file": "",
Refactor docs
2020-03-04 22:10:58 +00:00
"enabled_ssh_commands": [
"md5sum",
"sha1sum",
"cd",
enable scp in default configuration remove the deprecated enable_scp setting
2020-03-26 22:38:24 +00:00
"pwd",
"scp"
Refactor docs
2020-03-04 22:10:58 +00:00
],
multi-step auth: don't advertise password method if it is disabled also rename the settings to password_authentication so it is more like OpenSSH, add some test cases and improve documentation
2020-09-01 17:34:40 +00:00
"keyboard_interactive_auth_hook": "",
"password_authentication": true
Support multiple private (host) keys With this patch, one can configure one or more private (host) keys in the configuration file. I made it a nested struct, so we can add more options later. Eg. host certificates might be a useful addition if I can figure out how this is done in golang's crypto/ssh... Signed-off-by: Jo Vandeginste <Jo.Vandeginste@kuleuven.be>
2019-08-01 07:42:15 +00:00
},
add support for the venerable FTP protocol Fixes #46
2020-07-29 19:56:56 +00:00
"ftpd": {
add support for multiple bindings Fixes #253
2020-12-23 15:12:30 +00:00
"bindings": [
{
"port": 0,
defender: minor docs improvements
2021-01-02 19:02:05 +00:00
"address": "",
add support for multiple bindings Fixes #253
2020-12-23 15:12:30 +00:00
"apply_proxy_config": true,
"tls_mode": 0,
FTP: add support for client certificate authentication
2020-12-29 08:20:09 +00:00
"force_passive_ip": "",
TLS: allow to configure cipher suites Fixes #316
2021-02-18 19:17:16 +00:00
"client_auth_type": 0,
"tls_cipher_suites": []
add support for multiple bindings Fixes #253
2020-12-23 15:12:30 +00:00
}
],
add support for the venerable FTP protocol Fixes #46
2020-07-29 19:56:56 +00:00
"banner": "",
"banner_file": "",
add support for multiple bindings Fixes #253
2020-12-23 15:12:30 +00:00
"active_transfers_port_non_20": true,
add support for the venerable FTP protocol Fixes #46
2020-07-29 19:56:56 +00:00
"passive_port_range": {
"start": 50000,
"end": 50100
},
improve FTP support - allow to disable active mode - allow to disable SITE commands - add optional support for calculating hash value of files - add optional support for the non standard COMB command
2020-12-24 17:48:06 +00:00
"disable_active_mode": false,
"enable_site": false,
"hash_support": 0,
"combine_support": 0,
add support for the venerable FTP protocol Fixes #46
2020-07-29 19:56:56 +00:00
"certificate_file": "",
FTP: add support for client certificate authentication
2020-12-29 08:20:09 +00:00
"certificate_key_file": "",
mutal TLS: add support for revocation lists
2021-01-03 16:03:04 +00:00
"ca_certificates": [],
"ca_revocation_lists": []
add support for the venerable FTP protocol Fixes #46
2020-07-29 19:56:56 +00:00
},
add WebDAV support Fixes #147
2020-08-11 21:56:10 +00:00
"webdavd": {
add support for multiple bindings Fixes #253
2020-12-23 15:12:30 +00:00
"bindings": [
{
"port": 0,
defender: minor docs improvements
2021-01-02 19:02:05 +00:00
"address": "",
webdav: add support for client certificate authentication Fixes #263
2020-12-28 18:48:23 +00:00
"enable_https": false,
TLS: allow to configure cipher suites Fixes #316
2021-02-18 19:17:16 +00:00
"client_auth_type": 0,
webdav: add prefix support
2021-03-07 16:10:45 +00:00
"tls_cipher_suites": [],
"prefix": ""
add support for multiple bindings Fixes #253
2020-12-23 15:12:30 +00:00
}
],
add WebDAV support Fixes #147
2020-08-11 21:56:10 +00:00
"certificate_file": "",
WebDAV: add CORS support
2020-08-15 13:55:20 +00:00
"certificate_key_file": "",
webdav: add support for client certificate authentication Fixes #263
2020-12-28 18:48:23 +00:00
"ca_certificates": [],
mutal TLS: add support for revocation lists
2021-01-03 16:03:04 +00:00
"ca_revocation_lists": [],
WebDAV: add CORS support
2020-08-15 13:55:20 +00:00
"cors": {
"enabled": false,
"allowed_origins": [],
"allowed_methods": [],
"allowed_headers": [],
"exposed_headers": [],
"allow_credentials": false,
"max_age": 0
WebDAV: add caching for authenticated users In this way we get a big performance boost
2020-08-31 17:25:17 +00:00
},
"cache": {
webdav: performance improvements and bug fixes we need my custom golang/x/net/webdav fork for now https://github.com/drakkan/net/tree/sftpgo
2020-11-04 18:11:40 +00:00
"users": {
"expiration_time": 0,
"max_size": 50
},
"mime_types": {
"enabled": true,
"max_size": 1000
}
WebDAV: add CORS support
2020-08-15 13:55:20 +00:00
}
add WebDAV support Fixes #147
2020-08-11 21:56:10 +00:00
},
Support multiple private (host) keys With this patch, one can configure one or more private (host) keys in the configuration file. I made it a nested struct, so we can add more options later. Eg. host certificates might be a useful addition if I can figure out how this is done in golang's crypto/ssh... Signed-off-by: Jo Vandeginste <Jo.Vandeginste@kuleuven.be>
2019-08-01 07:42:15 +00:00
"data_provider": {
"driver": "sqlite",
"name": "sftpgo.db",
"host": "",
virtual folders: change dataprovider structure This way we no longer depend on the local file system path and so we can add support for cloud backends in future updates
2021-02-01 18:04:15 +00:00
"port": 0,
Support multiple private (host) keys With this patch, one can configure one or more private (host) keys in the configuration file. I made it a nested struct, so we can add more options later. Eg. host certificates might be a useful addition if I can figure out how this is done in golang's crypto/ssh... Signed-off-by: Jo Vandeginste <Jo.Vandeginste@kuleuven.be>
2019-08-01 07:42:15 +00:00
"username": "",
"password": "",
"sslmode": 0,
"connection_string": "",
refactor virtual folders The same virtual folder can now be shared among users and different folder quota limits for each user are supported. Fixes #120
2020-06-07 21:30:18 +00:00
"sql_tables_prefix": "",
dataprovider: remove transaction for quota update The update is atomic so no transaction is needed. Addionally a transaction will ask for a new connection to the pool and this can deadlock if the pool has a max connection limit too low. Also make configurable the pool size instead of hard code to the cpu number. Fixes #47
2019-09-13 06:14:07 +00:00
"track_quota": 2,
add support for users' default base dir
2019-09-28 20:48:52 +00:00
"pool_size": 0,
dataprovider: add custom command and/or HTTP notifications on users add, update and delete This way custom logic can be implemented for example to create a UNIX user as asked in #58
2019-11-14 10:06:03 +00:00
"users_base_dir": "",
"actions": {
"execute_on": [],
actions: add a generic hook to define external commands and HTTP URL We can only define a single hook now and it can be an HTTP notification or an external command, not both
2020-05-24 13:29:39 +00:00
"hook": ""
add support for authentication using external programs Fixes #62
2020-01-06 20:42:41 +00:00
},
add HTTP hooks external auth, pre-login user modification and keyboard interactive authentication is now supported via HTTP requests too
2020-04-01 21:25:23 +00:00
"external_auth_hook": "",
add support for serving Google Cloud Storage over SFTP/SCP Each user can be mapped with a Google Cloud Storage bucket or a bucket virtual folder
2020-01-31 18:04:00 +00:00
"external_auth_scope": 0,
add support for dynamic users modifications A custom program can be executed before the users login to modify the configurations for the user trying to login. You can, for example, allow login based on time range. Fixes #77
2020-02-23 17:50:59 +00:00
"credentials_path": "credentials",
add prefer_database_credentials configuration parameter When true, users' Google Cloud Storage credentials will be written to the data provider instead of disk. Pre-existing credentials on disk will be used as a fallback Fixes #201
2020-10-22 08:42:40 +00:00
"prefer_database_credentials": false,
add post-login hook a login scope is supported too so you can get notifications for failed logins, successful logins or both
2020-08-12 14:15:12 +00:00
"pre_login_hook": "",
"post_login_hook": "",
add check password hook its main use case is to allow to easily support things like password+OTP for protocols without keyboard interactive support such as FTP and WebDAV
2020-08-19 17:36:12 +00:00
"post_login_scope": 0,
"check_password_hook": "",
password hashing: exposes argon2 options So the hashing complexity can be changed depending on available memory/CPU resources and business requirements
2020-09-04 15:09:31 +00:00
"check_password_scope": 0,
"password_hashing": {
"argon2_options": {
"memory": 65536,
"iterations": 1,
"parallelism": 2
}
data provider: add a setting to prevent auto-update
2020-10-05 17:42:33 +00:00
},
add a setting to skip natural keys validation Enabling the "skip_natural_keys_validation" data provider setting, the natural keys for REST API/Web Admin as usernames, admin names, folder names are not restricted to unreserved URI chars Fixes #334 #308
2021-03-04 08:48:53 +00:00
"update_mode": 0,
"skip_natural_keys_validation": false
Support multiple private (host) keys With this patch, one can configure one or more private (host) keys in the configuration file. I made it a nested struct, so we can add more options later. Eg. host certificates might be a useful addition if I can figure out how this is done in golang's crypto/ssh... Signed-off-by: Jo Vandeginste <Jo.Vandeginste@kuleuven.be>
2019-08-01 07:42:15 +00:00
},
"httpd": {
httpd: add mTLS and multiple bindings support
2021-01-19 17:59:41 +00:00
"bindings": [
{
"port": 8080,
"address": "127.0.0.1",
"enable_web_admin": true,
"enable_https": false,
TLS: allow to configure cipher suites Fixes #316
2021-02-18 19:17:16 +00:00
"client_auth_type": 0,
"tls_cipher_suites": []
httpd: add mTLS and multiple bindings support
2021-01-19 17:59:41 +00:00
}
],
add a basic web interface The builtin web interface allows to manage users and connections
2019-10-07 16:19:01 +00:00
"templates_path": "templates",
add backup/restore REST API
2019-12-27 22:12:44 +00:00
"static_files_path": "static",
httpd: add support for basic auth and HTTPS
2020-02-03 23:08:00 +00:00
"backups_path": "backups",
"certificate_file": "",
httpd: add mTLS and multiple bindings support
2021-01-19 17:59:41 +00:00
"certificate_key_file": "",
"ca_certificates": [],
"ca_revocation_lists": []
add a new configuration section for HTTP clients HTTP clients are used for executing hooks such as the ones used for custom actions, external authentication and pre-login user modifications. This allows, for example, to use self-signed certificate without defeating the purpose of using TLS
2020-04-26 21:29:09 +00:00
},
add some docs for telemetry server move pprof to the telemetry server only
2020-12-18 08:47:22 +00:00
"telemetry": {
"bind_port": 10000,
telemetry server: add optional https and authentication
2020-12-18 15:04:42 +00:00
"bind_address": "127.0.0.1",
"enable_profiler": false,
"auth_user_file": "",
"certificate_file": "",
TLS: allow to configure cipher suites Fixes #316
2021-02-18 19:17:16 +00:00
"certificate_key_file": "",
"tls_cipher_suites": []
add some docs for telemetry server move pprof to the telemetry server only
2020-12-18 08:47:22 +00:00
},
add a new configuration section for HTTP clients HTTP clients are used for executing hooks such as the ones used for custom actions, external authentication and pre-login user modifications. This allows, for example, to use self-signed certificate without defeating the purpose of using TLS
2020-04-26 21:29:09 +00:00
"http": {
"timeout": 20,
web hooks: improve resilience by adding a configurable retry the retryable http client is used for hooks that notify events
2021-02-12 20:42:49 +00:00
"retry_wait_min": 2,
"retry_wait_max": 30,
"retry_max": 3,
httpclient: add a configuration parameter to skip TLS certificate validation In this mode, TLS is susceptible to man-in-the-middle attacks. This should be used only for testing.
2020-05-03 09:37:50 +00:00
"ca_certificates": [],
web hooks: add mutual TLS support
2021-02-13 13:41:37 +00:00
"certificates": [],
httpclient: add a configuration parameter to skip TLS certificate validation In this mode, TLS is susceptible to man-in-the-middle attacks. This should be used only for testing.
2020-05-03 09:37:50 +00:00
"skip_tls_verify": false
add KMS support Fixes #226
2020-11-30 20:46:34 +00:00
},
"kms": {
"secrets": {
"url": "",
"master_key_path": ""
}
Support multiple private (host) keys With this patch, one can configure one or more private (host) keys in the configuration file. I made it a nested struct, so we can add more options later. Eg. host certificates might be a useful addition if I can figure out how this is done in golang's crypto/ssh... Signed-off-by: Jo Vandeginste <Jo.Vandeginste@kuleuven.be>
2019-08-01 07:42:15 +00:00
}
fix default config file restore a setting changed for a local test
2020-10-31 10:34:50 +00:00
}
Reference in a new issue Copy permalink