The release of SFTPGo server 2.5.0 has been published, allowing remote access to files via SFTP, SCP/SSH, Rsync, HTTP, and WebDav protocols, as well as providing access to Git repositories using the SSH protocol. Data can be served from both local file systems and external storage compatible with Amazon S3, Google Cloud Storage, and Azure Blob Storage. Data can be stored in an encrypted format. For storing the user database and metadata, databases supporting SQL or key/value formats are used, such as PostgreSQL, MySQL, SQLite, CockroachDB, or bbolt, but there is also an option to store metadata in memory without requiring an external database connection. The project code is written in the Go language and is distributed under the GPLv3 license.
In the new version:
- The web interface now provides the ability to close error messages. In the admin web interface, support for searching the audit log and exporting data from it has been added, as well as management of lists. (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community. and networks, with the ability to configure SMTP and standard ACME and SFTP parameters. In the client web interface, a custom login form has been implemented (instead of basic auth), with added copy operations and the removal of upload size restrictions.
- Support for password usage policies has been added, allowing requirements for password strength to be defined and password expiration times to be set.
- In the EventManager, the ability to output notifications about expired passwords has been introduced, along with copy operations, and support for pre-called actions (pre-*) and handlers that trigger on certain actions (for example, a handler triggered upon user login has been added).
- The ability to grant users administrator rights has been added.
- The command line interface has been enhanced with commands to reset the administrator password and check the service's operational status.
- Support for conditional operators during bulk renaming of files on the side of cloud providers has been added.
- Support for tracking and automatic reloading has been added. for TLS certificates.
- The ability to define custom MIME types for WebDAV has been introduced.
- Interactive keyboard authentication is enabled by default for SSH.
- In portable mode, the ability to upload passwords from a file has been added.
- Experimental support for the Terraform service has been added.
Key features of SFTPGo:
- Chroot isolation is applied to each account, restricting access to the user's home directory. Virtual directories can be created that reference data outside the user's home directory.
- Accounts are stored in a virtual user database that does not overlap with the system user DB. SQLite, MySQL, PostgreSQL, bbolt, and in-memory storage can be used for the user database. Tools are provided for mapping virtual and system accounts — direct or arbitrary mapping is possible (one system user may be mapped to another virtual user).
- Authentication using public keys, SSH keys, and passwords is supported (including interactive password input via the keyboard). Multiple keys can be bound for each user, and multi-factor and multi-stage authentication can be configured (for example, after successful key authentication, a password may be additionally requested).
- Different authentication methods can be configured for each user, as well as custom methods implemented through calls to external authentication programs (for instance, for LDAP authentication) or sending requests via an HTTP API.
- External handlers or HTTP API calls can be connected to dynamically change user parameters, invoked before user login. Dynamic user creation is supported upon connection.
- Support for individual quotas on data size and number of files.
- Support for bandwidth limitation with separate configuration of restrictions for incoming and outgoing traffic, as well as restrictions on the number of simultaneous connections.
- Access control mechanisms that work in relation to the user or directory (you can restrict file list viewing, prohibit uploads, downloads, overwrites, deletions, renaming, or permissions changes, and prohibit directory or symbolic link creation, etc.).
- You can set individual network limits for each user, such as allowing access only from specific IPs or subnets.
- Support for attaching content upload filters tied to individual users and directories (for example, it is possible to block the uploading of files with certain extensions).
- Binding handlers that trigger on various file operations (upload, delete, rename, etc.) is possible. In addition to invoking handlers, sending notifications in the form of HTTP requests is supported.
- Automatic termination of inactive connections.
- Atomic configuration updates without breaking connections.
- Providing metrics for monitoring in Prometheus.
- Support for the HAProxy PROXY protocol for load balancing or proxying connections to SFTP/SCP services without losing the original user's IP address information.
- REST API for managing users and directories, creating backups, and generating reports on active connections.
- Web interface (http://127.0.0.1:8080/web) for configuration and monitoring (configuration via regular configuration files is also supported).
- Ability to define settings in JSON, TOML, YAML, HCL, and envfile formats.
- Support for SSH access with limited access to system commands. For example, the execution of commands necessary for Git operation (git-receive-pack, git-upload-pack, git-upload-archive) and rsync, as well as several built-in commands (scp, md5sum, sha*sum, cd, pwd, sftpgo-copy, and sftpgo-remove) is allowed.
- Portable mode for sharing a common directory with automatic generation of connection credentials, announced via multicast DNS.
- Built-in profiling system for performance analysis.
- Simplified process for migrating Linux system accounts.
- Storing logs in JSON format.
- Support for virtual directories (for example, the content of a specific directory can be served not from the local file system, but from an external cloud storage).
- Support for cryptfs for transparent encryption of data on-the-fly when saved to the file system and decryption when served.
- Support for forwarding connections to other SFTP servers.
- Ability to use SFTPGo as an SFTP subsystem for OpenSSH.
- The ability to store accounting and confidential data in encrypted form using KMS servers (Key Management Services) such as Vault, GCP KMS, AWS KMS.
- Support for two-factor authentication using time-limited one-time passwords (TOTP, RFC 6238). Authenticators such as Authy and Google Authenticator can be used.
- Expanding functionality through plugins. For example, plugins are available that support additional key exchange services, integration of the Publish/Subscribe scheme, and storage and retrieval of event information in a database management system.
Source: opennet.ru
