The first significant release of the server has taken place , enabling remote access to files using SFTP, SCP/SSH, and Rsync protocols. Additionally, SFTPGo can be used to provide access to Git repositories via the SSH protocol. Data can be served from both the local file system and external storage compatible with Amazon S3 and Google Cloud Storage. For storing the user base and metadata, SQL-supported databases or key/value format solutions like PostgreSQL 9.4+, MySQL 5.6+, SQLite 3.x, or . There is also a mode for storing metadata in memory, which does not require connecting to an external database. The project code is written in Go and under the GPLv3 license.
Main features:
- Chroot isolation is applied to each account, restricting access to the user's home directory. Virtual directories can be created that reference data outside the user's home directory.
- Accounts are stored in a virtual user database that does not overlap with the system user DB. SQLite, MySQL, PostgreSQL, bbolt, and in-memory storage can be used for the user database. Tools are provided for mapping virtual and system accounts — direct or arbitrary mapping is possible (one system user may be mapped to another virtual user).
- Authentication using public keys, SSH keys, and passwords is supported (including interactive password input via the keyboard). Multiple keys can be bound for each user, and multi-factor and multi-stage authentication can be configured (for example, after successful key authentication, a password may be additionally requested).
- Different authentication methods can be configured for each user, as well as custom methods implemented through calls to external authentication programs (for instance, for LDAP authentication) or sending requests via an HTTP API.
- External handlers or HTTP API calls can be connected to dynamically change user parameters invoked before the user logs in. Dynamic user creation upon connection.
- Support for individual quotas on data size and number of files.
- Support for bandwidth limitation with separate configuration of restrictions for incoming and outgoing traffic, as well as restrictions on the number of simultaneous connections.
- Access control mechanisms that work in relation to the user or directory (you can restrict file list viewing, prohibit uploads, downloads, overwrites, deletions, renaming, or permissions changes, and prohibit directory or symbolic link creation, etc.).
- You can set individual network limits for each user, such as allowing access only from specific IPs or subnets.
- Support for attaching content upload filters tied to individual users and directories (for example, it is possible to block the uploading of files with certain extensions).
- Binding handlers that trigger on various file operations (upload, delete, rename, etc.) is possible. In addition to invoking handlers, sending notifications in the form of HTTP requests is supported.
- Automatic termination of inactive connections.
- Atomic configuration updates without breaking connections.
- metrics for monitoring in Prometheus.
- Support for the HAProxy PROXY protocol for load balancing or proxying connections to SFTP/SCP services without losing the original user's IP address information.
- for managing users and directories, creating backups, and generating reports on active connections.
- (http://127.0.0.1:8080/web) for configuration and monitoring (configuration can also be set up through regular configuration files).
- Ability to define settings in JSON, TOML, YAML, HCL, and envfile formats.
- SSH connections with restricted access to system commands. For example, the execution of commands necessary for Git operation (git-receive-pack, git-upload-pack, git-upload-archive) and rsync is allowed, along with several built-in commands (scp, md5sum, sha*sum, cd, pwd, sftpgo-copy, and sftpgo-remove).
- Mode for sharing a common directory with automatically generated connection credentials announced via multicast DNS.
- An integrated for performance analysis.
- Simplified migration of Linux system accounts.
- logs in JSON format.
Source: opennet.ru
