minio/docs/ftp

MinIO FTP/SFTP Server

MinIO natively supports FTP/SFTP protocol, this allows any ftp/sftp client to upload and download files.

Currently supported FTP/SFTP operations are as follows:

ftp-client commands	supported
get	yes
put	yes
ls	yes
mkdir	yes
rmdir	yes
delete	yes
append	no
rename	no

MinIO supports following FTP/SFTP based protocols to access and manage data.

• Secure File Transfer Protocol (SFTP) – Defined by the Internet Engineering Task Force (IETF) as an extended version of SSH 2.0, allowing file transfer over SSH and for use with Transport Layer Security (TLS) and VPN applications.

• File Transfer Protocol over SSL/TLS (FTPS) – Encrypted FTP communication via TLS certificates.

• File Transfer Protocol (FTP) – Defined by RFC114 originally, and replaced by RFC765 and RFC959 unencrypted FTP communication (Not-recommended)

Scope

• All IAM Credentials are allowed access excluding rotating credentials, rotating credentials are not allowed to login via FTP/SFTP ports, you must use S3 API port for if you are using rotating credentials.

• Access to bucket(s) and object(s) are governed via IAM policies associated with the incoming login credentials.

• Allows authentication and access for all

  • Built-in IDP users and their respective service accounts
  • LDAP/AD users and their respective service accounts
  • OpenID/OIDC service accounts

• On versioned buckets, FTP/SFTP only operates on latest objects, if you need to retrieve an older version you must use an S3 API client such as mc.

• All features currently used by your buckets will work as is without any changes

  • SSE (Server Side Encryption)
  • Replication (Server Side Replication)

Prerequisites

• It is assumed you have users created and configured with relevant access policies, to start with use basic "readwrite" canned policy to test all the operations before you finalize on what level of restrictions are needed for a user.

• No "admin:*" operations are needed for FTP/SFTP access to the bucket(s) and object(s), so you may skip them for restrictions.

Usage

Start MinIO in a distributed setup, with 'ftp/sftp' enabled.

minio server http://server{1...4}/disk{1...4}
   --ftp="address=:8021" --ftp="passive-port-range=30000-40000" \
   --sftp="address=:8022" --sftp="ssh-private-key=/home/miniouser/.ssh/id_rsa"
...
...

Following example shows connecting via ftp client using minioadmin credentials, and list a bucket named runner:

ftp localhost -P 8021
Connected to localhost.
220 Welcome to MinIO FTP Server
Name (localhost:user): minioadmin
331 User name ok, password required
Password:
230 Password ok, continue
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls runner/
229 Entering Extended Passive Mode (|||39155|)
150 Opening ASCII mode data connection for file list
drwxrwxrwx 1 nobody nobody            0 Jan  1 00:00 chunkdocs/
drwxrwxrwx 1 nobody nobody            0 Jan  1 00:00 testdir/
...

Following example shows how to list an object and download it locally via ftp client:

ftp> ls runner/chunkdocs/metadata
229 Entering Extended Passive Mode (|||44269|)
150 Opening ASCII mode data connection for file list
-rwxrwxrwx 1 nobody nobody           45 Apr  1 06:13 chunkdocs/metadata
226 Closing data connection, sent 75 bytes
ftp> get
(remote-file) runner/chunkdocs/metadata
(local-file) test
local: test remote: runner/chunkdocs/metadata
229 Entering Extended Passive Mode (|||37785|)
150 Data transfer starting 45 bytes
	45        3.58 KiB/s
226 Closing data connection, sent 45 bytes
45 bytes received in 00:00 (3.55 KiB/s)
...

Following example shows connecting via sftp client using minioadmin credentials, and list a bucket named runner:

sftp -P 8022 minioadmin@localhost
minioadmin@localhost's password:
Connected to localhost.
sftp> ls runner/
chunkdocs  testdir

Following example shows how to download an object locally via sftp client:

sftp> get runner/chunkdocs/metadata metadata
Fetching /runner/chunkdocs/metadata to metadata
metadata                                                                                                                                                                       100%  226    16.6KB/s   00:00
sftp>

Advanced options

Change default FTP port

Default port '8021' can be changed via

--ftp="address=:3021"

Change FTP passive port range

By default FTP requests OS to give a free port automatically, however you may want to restrict this to specific ports in certain restricted environments via

--ftp="passive-port-range=30000-40000"

Change default SFTP port

Default port '8022' can be changed via

--sftp="address=:3022"

TLS (FTP)

Unlike SFTP server, FTP server is insecure by default. To operate under TLS mode, you need to provide certificates via

--ftp="tls-private-key=path/to/private.key" --ftp="tls-public-cert=path/to/public.crt"

NOTE: if MinIO distributed setup is already configured to run under TLS, FTP will automatically use the relevant certs from the server certificate chain, this is mainly to add simplicity of setup. However if you wish to terminate TLS certificates via a different domain for your FTP servers you may choose the above command line options.

Custom Algorithms (SFTP)

Custom algorithms can be specified via command line parameters. Algorithms are comma separated. Note that valid values does not in all cases represent default values.

--sftp=pub-key-algos=... specifies the supported client public key authentication algorithms. Note that this doesn't include certificate types since those use the underlying algorithm. This list is sent to the client if it supports the server-sig-algs extension. Order is irrelevant.

Valid values

ssh-ed25519
sk-ssh-ed25519@openssh.com
sk-ecdsa-sha2-nistp256@openssh.com
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
rsa-sha2-256
rsa-sha2-512
ssh-rsa
ssh-dss

--sftp=kex-algos=... specifies the supported key-exchange algorithms in preference order.

Valid values:

curve25519-sha256
curve25519-sha256@libssh.org
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group14-sha1
diffie-hellman-group1-sha1

--sftp=cipher-algos=... specifies the allowed cipher algorithms. If unspecified then a sensible default is used.

Valid values:

aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com
chacha20-poly1305@openssh.com
arcfour256
arcfour128
arcfour
aes128-cbc
3des-cbc

--sftp=mac-algos=... specifies a default set of MAC algorithms in preference order. This is based on RFC 4253, section 6.4, but with hmac-md5 variants removed because they have reached the end of their useful life.

Valid values:

hmac-sha2-256-etm@openssh.com
hmac-sha2-512-etm@openssh.com
hmac-sha2-256
hmac-sha2-512
hmac-sha1
hmac-sha1-96

Certificate-based authentication

--sftp=trusted-user-ca-key=... specifies a file containing public key of certificate authority that is trusted to sign user certificates for authentication.

Implementation is identical with "TrustedUserCAKeys" setting in OpenSSH server with exception that only one CA key can be defined.

If a certificate is presented for authentication and has its signing CA key is in this file, then it may be used for authentication for any user listed in the certificate's principals list.

Note that certificates that lack a list of principals will not be permitted for authentication using trusted-user-ca-key. For more details on certificates, see the CERTIFICATES section in ssh-keygen(1).