OP#792 initial commit after fork
This commit is contained in:
257
docs/ftp/README.md
Normal file
257
docs/ftp/README.md
Normal file
@@ -0,0 +1,257 @@
|
||||
# MinIO FTP/SFTP Server
|
||||
|
||||
MinIO natively supports FTP/SFTP protocol, this allows any ftp/sftp client to upload and download files.
|
||||
|
||||
Currently supported `FTP/SFTP` operations are as follows:
|
||||
|
||||
| ftp-client commands | supported |
|
||||
|:-------------------:|:----------|
|
||||
| get | yes |
|
||||
| put | yes |
|
||||
| ls | yes |
|
||||
| mkdir | yes |
|
||||
| rmdir | yes |
|
||||
| delete | yes |
|
||||
| append | no |
|
||||
| rename | no |
|
||||
|
||||
MinIO supports following FTP/SFTP based protocols to access and manage data.
|
||||
|
||||
- Secure File Transfer Protocol (SFTP) – Defined by the Internet Engineering Task Force (IETF) as an
|
||||
extended version of SSH 2.0, allowing file transfer over SSH and for use with Transport Layer
|
||||
Security (TLS) and VPN applications.
|
||||
|
||||
- File Transfer Protocol over SSL/TLS (FTPS) – Encrypted FTP communication via TLS certificates.
|
||||
|
||||
- File Transfer Protocol (FTP) – Defined by RFC114 originally, and replaced by RFC765 and RFC959
|
||||
unencrypted FTP communication (Not-recommended)
|
||||
|
||||
## Scope
|
||||
|
||||
- All IAM Credentials are allowed access excluding rotating credentials, rotating credentials
|
||||
are not allowed to login via FTP/SFTP ports, you must use S3 API port for if you are using
|
||||
rotating credentials.
|
||||
|
||||
- Access to bucket(s) and object(s) are governed via IAM policies associated with the incoming
|
||||
login credentials.
|
||||
|
||||
- Allows authentication and access for all
|
||||
- Built-in IDP users and their respective service accounts
|
||||
- LDAP/AD users and their respective service accounts
|
||||
- OpenID/OIDC service accounts
|
||||
|
||||
- On versioned buckets, FTP/SFTP only operates on latest objects, if you need to retrieve
|
||||
an older version you must use an `S3 API client` such as [`mc`](https://github.com/minio/mc).
|
||||
|
||||
- All features currently used by your buckets will work as is without any changes
|
||||
- SSE (Server Side Encryption)
|
||||
- Replication (Server Side Replication)
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- It is assumed you have users created and configured with relevant access policies, to start with
|
||||
use basic "readwrite" canned policy to test all the operations before you finalize on what level
|
||||
of restrictions are needed for a user.
|
||||
|
||||
- No "admin:*" operations are needed for FTP/SFTP access to the bucket(s) and object(s), so you may
|
||||
skip them for restrictions.
|
||||
|
||||
## Usage
|
||||
|
||||
Start MinIO in a distributed setup, with 'ftp/sftp' enabled.
|
||||
|
||||
```
|
||||
minio server http://server{1...4}/disk{1...4}
|
||||
--ftp="address=:8021" --ftp="passive-port-range=30000-40000" \
|
||||
--sftp="address=:8022" --sftp="ssh-private-key=/home/miniouser/.ssh/id_rsa"
|
||||
...
|
||||
...
|
||||
```
|
||||
|
||||
Following example shows connecting via ftp client using `minioadmin` credentials, and list a bucket named `runner`:
|
||||
|
||||
```
|
||||
ftp localhost -P 8021
|
||||
Connected to localhost.
|
||||
220 Welcome to MinIO FTP Server
|
||||
Name (localhost:user): minioadmin
|
||||
331 User name ok, password required
|
||||
Password:
|
||||
230 Password ok, continue
|
||||
Remote system type is UNIX.
|
||||
Using binary mode to transfer files.
|
||||
ftp> ls runner/
|
||||
229 Entering Extended Passive Mode (|||39155|)
|
||||
150 Opening ASCII mode data connection for file list
|
||||
drwxrwxrwx 1 nobody nobody 0 Jan 1 00:00 chunkdocs/
|
||||
drwxrwxrwx 1 nobody nobody 0 Jan 1 00:00 testdir/
|
||||
...
|
||||
```
|
||||
|
||||
Following example shows how to list an object and download it locally via `ftp` client:
|
||||
|
||||
```
|
||||
ftp> ls runner/chunkdocs/metadata
|
||||
229 Entering Extended Passive Mode (|||44269|)
|
||||
150 Opening ASCII mode data connection for file list
|
||||
-rwxrwxrwx 1 nobody nobody 45 Apr 1 06:13 chunkdocs/metadata
|
||||
226 Closing data connection, sent 75 bytes
|
||||
ftp> get
|
||||
(remote-file) runner/chunkdocs/metadata
|
||||
(local-file) test
|
||||
local: test remote: runner/chunkdocs/metadata
|
||||
229 Entering Extended Passive Mode (|||37785|)
|
||||
150 Data transfer starting 45 bytes
|
||||
45 3.58 KiB/s
|
||||
226 Closing data connection, sent 45 bytes
|
||||
45 bytes received in 00:00 (3.55 KiB/s)
|
||||
...
|
||||
```
|
||||
|
||||
|
||||
Following example shows connecting via sftp client using `minioadmin` credentials, and list a bucket named `runner`:
|
||||
|
||||
```
|
||||
sftp -P 8022 minioadmin@localhost
|
||||
minioadmin@localhost's password:
|
||||
Connected to localhost.
|
||||
sftp> ls runner/
|
||||
chunkdocs testdir
|
||||
```
|
||||
|
||||
Following example shows how to download an object locally via `sftp` client:
|
||||
|
||||
```
|
||||
sftp> get runner/chunkdocs/metadata metadata
|
||||
Fetching /runner/chunkdocs/metadata to metadata
|
||||
metadata 100% 226 16.6KB/s 00:00
|
||||
sftp>
|
||||
```
|
||||
|
||||
## Advanced options
|
||||
|
||||
### Change default FTP port
|
||||
|
||||
Default port '8021' can be changed via
|
||||
|
||||
```
|
||||
--ftp="address=:3021"
|
||||
```
|
||||
|
||||
### Change FTP passive port range
|
||||
|
||||
By default FTP requests OS to give a free port automatically, however you may want to restrict
|
||||
this to specific ports in certain restricted environments via
|
||||
|
||||
```
|
||||
--ftp="passive-port-range=30000-40000"
|
||||
```
|
||||
|
||||
### Change default SFTP port
|
||||
|
||||
Default port '8022' can be changed via
|
||||
|
||||
```
|
||||
--sftp="address=:3022"
|
||||
```
|
||||
|
||||
### TLS (FTP)
|
||||
|
||||
Unlike SFTP server, FTP server is insecure by default. To operate under TLS mode, you need to provide certificates via
|
||||
|
||||
```
|
||||
--ftp="tls-private-key=path/to/private.key" --ftp="tls-public-cert=path/to/public.crt"
|
||||
```
|
||||
|
||||
> NOTE: if MinIO distributed setup is already configured to run under TLS, FTP will automatically use the relevant
|
||||
> certs from the server certificate chain, this is mainly to add simplicity of setup. However if you wish to terminate
|
||||
> TLS certificates via a different domain for your FTP servers you may choose the above command line options.
|
||||
|
||||
|
||||
### Custom Algorithms (SFTP)
|
||||
|
||||
Custom algorithms can be specified via command line parameters.
|
||||
Algorithms are comma separated.
|
||||
Note that valid values does not in all cases represent default values.
|
||||
|
||||
`--sftp=pub-key-algos=...` specifies the supported client public key
|
||||
authentication algorithms. Note that this doesn't include certificate types
|
||||
since those use the underlying algorithm. This list is sent to the client if
|
||||
it supports the server-sig-algs extension. Order is irrelevant.
|
||||
|
||||
Valid values
|
||||
```
|
||||
ssh-ed25519
|
||||
sk-ssh-ed25519@openssh.com
|
||||
sk-ecdsa-sha2-nistp256@openssh.com
|
||||
ecdsa-sha2-nistp256
|
||||
ecdsa-sha2-nistp384
|
||||
ecdsa-sha2-nistp521
|
||||
rsa-sha2-256
|
||||
rsa-sha2-512
|
||||
ssh-rsa
|
||||
ssh-dss
|
||||
```
|
||||
|
||||
`--sftp=kex-algos=...` specifies the supported key-exchange algorithms in preference order.
|
||||
|
||||
Valid values:
|
||||
|
||||
```
|
||||
curve25519-sha256
|
||||
curve25519-sha256@libssh.org
|
||||
ecdh-sha2-nistp256
|
||||
ecdh-sha2-nistp384
|
||||
ecdh-sha2-nistp521
|
||||
diffie-hellman-group14-sha256
|
||||
diffie-hellman-group16-sha512
|
||||
diffie-hellman-group14-sha1
|
||||
diffie-hellman-group1-sha1
|
||||
```
|
||||
|
||||
`--sftp=cipher-algos=...` specifies the allowed cipher algorithms.
|
||||
If unspecified then a sensible default is used.
|
||||
|
||||
Valid values:
|
||||
```
|
||||
aes128-ctr
|
||||
aes192-ctr
|
||||
aes256-ctr
|
||||
aes128-gcm@openssh.com
|
||||
aes256-gcm@openssh.com
|
||||
chacha20-poly1305@openssh.com
|
||||
arcfour256
|
||||
arcfour128
|
||||
arcfour
|
||||
aes128-cbc
|
||||
3des-cbc
|
||||
```
|
||||
|
||||
`--sftp=mac-algos=...` specifies a default set of MAC algorithms in preference order.
|
||||
This is based on RFC 4253, section 6.4, but with hmac-md5 variants removed because they have
|
||||
reached the end of their useful life.
|
||||
|
||||
Valid values:
|
||||
|
||||
```
|
||||
hmac-sha2-256-etm@openssh.com
|
||||
hmac-sha2-512-etm@openssh.com
|
||||
hmac-sha2-256
|
||||
hmac-sha2-512
|
||||
hmac-sha1
|
||||
hmac-sha1-96
|
||||
```
|
||||
|
||||
### Certificate-based authentication
|
||||
|
||||
`--sftp=trusted-user-ca-key=...` specifies a file containing public key of certificate authority that is trusted
|
||||
to sign user certificates for authentication.
|
||||
|
||||
Implementation is identical with "TrustedUserCAKeys" setting in OpenSSH server with exception that only one CA
|
||||
key can be defined.
|
||||
|
||||
If a certificate is presented for authentication and has its signing CA key is in this file, then it may be
|
||||
used for authentication for any user listed in the certificate's principals list.
|
||||
|
||||
Note that certificates that lack a list of principals will not be permitted for authentication using trusted-user-ca-key.
|
||||
For more details on certificates, see the CERTIFICATES section in ssh-keygen(1).
|
||||
Reference in New Issue
Block a user