The release of SFTPGo server 2.2 has been published, allowing remote file access using SFTP, SCP/SSH, Rsync, HTTP, and WebDav protocols. SFTPGo can also be used to provide access to Git repositories using the SSH protocol. Data can be served from both local file systems and external storage compatible with Amazon S3, Google Cloud Storage, and Azure Blob Storage. It supports data storage in encrypted form. For user database and metadata storage, it utilizes SQL-supporting databases or key/value formats such as PostgreSQL, MySQL, SQLite, CockroachDB, or bbolt, but also includes the option for in-memory metadata storage without requiring an external database connection. The project code is written in Go and is distributed under the GPLv3 license.
In the new version:
- Two-factor authentication support has been added using time-limited one-time passwords (TOTP, RFC 6238). Authenticators such as Authy and Google Authenticator can be used.
- The ability to extend functionality through plugins has been implemented. Among the available plugins are support for additional key exchange services, integration of the Publish/Subscribe scheme, and storage and search of event information in the database.
- The REST API now supports key-based authentication in addition to JWT tokens, and allows for data retention policies (data lifespan limits) tied to specific directories and users. By default, the Swagger UI interface is activated for navigating API resources without external tools.
- The web interface has been enhanced with support for write operations (file uploads, directory creation, renaming, and deletion), the ability to reset passwords with email confirmation, integrated text file editors, and PDF document viewers. It also added the capability to create HTTP links for providing external users access to specific files and directories, with the option to set a unique access password, limit the lifespan of the link, and restrict the number of downloads. IP addresses, set link expiration, and limit the number of downloads.
Key features of SFTPGo:
- Chroot isolation is applied to each account, restricting access to the user's home directory. Virtual directories can be created that reference data outside the user's home directory.
- Accounts are stored in a virtual user database that does not overlap with the system user DB. SQLite, MySQL, PostgreSQL, bbolt, and in-memory storage can be used for the user database. Tools are provided for mapping virtual and system accounts — direct or arbitrary mapping is possible (one system user may be mapped to another virtual user).
- Authentication using public keys, SSH keys, and passwords is supported (including interactive password input via the keyboard). Multiple keys can be bound for each user, and multi-factor and multi-stage authentication can be configured (for example, after successful key authentication, a password may be additionally requested).
- Different authentication methods can be configured for each user, as well as custom methods implemented through calls to external authentication programs (for instance, for LDAP authentication) or sending requests via an HTTP API.
- External handlers or HTTP API calls can be connected to dynamically change user parameters, invoked before user login. Dynamic user creation is supported upon connection.
- Support for individual quotas on data size and number of files.
- Support for bandwidth limitation with separate configuration of restrictions for incoming and outgoing traffic, as well as restrictions on the number of simultaneous connections.
- Access control mechanisms that work in relation to the user or directory (you can restrict file list viewing, prohibit uploads, downloads, overwrites, deletions, renaming, or permissions changes, and prohibit directory or symbolic link creation, etc.).
- You can set individual network limits for each user, such as allowing access only from specific IPs or subnets.
- Support for attaching content upload filters tied to individual users and directories (for example, it is possible to block the uploading of files with certain extensions).
- Binding handlers that trigger on various file operations (upload, delete, rename, etc.) is possible. In addition to invoking handlers, sending notifications in the form of HTTP requests is supported.
- Automatic termination of inactive connections.
- Atomic configuration updates without breaking connections.
- Providing metrics for monitoring in Prometheus.
- Support for the HAProxy PROXY protocol for load balancing or proxying connections to SFTP/SCP services without losing the original user's IP address information.
- REST API for managing users and directories, creating backups, and generating reports on active connections.
- Web interface (http://127.0.0.1:8080/web) for configuration and monitoring (configuration via regular configuration files is also supported).
- Ability to define settings in JSON, TOML, YAML, HCL, and envfile formats.
- Support for SSH access with limited access to system commands. For example, the execution of commands necessary for Git operation (git-receive-pack, git-upload-pack, git-upload-archive) and rsync, as well as several built-in commands (scp, md5sum, sha*sum, cd, pwd, sftpgo-copy, and sftpgo-remove) is allowed.
- Portable mode for sharing a common directory with automatic generation of connection credentials, announced via multicast DNS.
- Built-in profiling system for performance analysis.
- Simplified process for migrating Linux system accounts.
- Storing logs in JSON format.
- Support for virtual directories (for example, the content of a specific directory can be served not from the local file system, but from an external cloud storage).
- Support for cryptfs for transparent encryption of data on-the-fly when saved to the file system and decryption when served.
- Support for forwarding connections to other SFTP servers.
- Ability to use SFTPGo as an SFTP subsystem for OpenSSH.
- The ability to store accounting and confidential data in encrypted form using KMS servers (Key Management Services) such as Vault, GCP KMS, AWS KMS.
Source: opennet.ru
