ftpserver

Golang FTP Server

This FTP server is a gateway between old-school FTP devices and modern cloud based file systems, using the afero's Fs interface and acting as a reference implementation of the ftpserverlib.

At the current stage, supported backend are:

• Local disk
• S3 through afero-s3
• Dropbox (see doc) through afero-dropbox
• Google Drive (see doc) through afero-gdrive
• SFTP through afero's sftpfs
• Email through go-mail thanks to @x-way
• Telegram through telebot by @slayer, see doc

And with those are supported common parameters to switch them to read-only, enable login access, or use a temporary directory file (see doc).

Current status of the project

Features

FTP protocol

These features are brought by ftpserverlib itself:

• Uploading and downloading files
• Directory listing (LIST + MLST)
• File and directory deletion and renaming
• TLS support (AUTH + PROT)
• File download/upload resume support (REST)
• Complete driver for all the above features
• Passive socket connections (EPSV and PASV commands)
• Active socket connections (PORT command)
• Small memory footprint
• Only relies on the standard library except for:
  • go-kit log for logging
  • afero for generic file systems handling
• Supported extensions:
  • AUTH - Control session protection
  • AUTH TLS - TLS session
  • PROT - Transfer protection
  • EPRT/EPSV - IPv6 support
  • MDTM - File Modification Time
  • SIZE - Size of a file
  • REST - Restart of interrupted transfer
  • MLST - Simple file listing for machine processing
  • MLSD - Directory listing for machine processing

Getting started

Get it

Download it

Fetch a binary for your platform from the latest release and run it. Archives are named ftpserver--- and are provided for Linux, macOS and Windows on amd64 and arm64, plus armv6/armv7 for Linux (Raspberry Pi and friends).

Build & run it locally

go install github.com/fclairamb/ftpserver@main

ftpserver &

Run it with docker

There's also a containerized version of the server (31MB, based on alpine).

# Creating a directory
mkdir -p files

# Starting the sample FTP server
docker run --rm -d -p 2121-2130:2121-2130 -v $(pwd)/files:/tmp -v $(pwd):/app fclairamb/ftpserver

Run it with docker compose

# docker-compose.yml

version: '3.3'
services:
  ftpserver:
    ports:
      - '2121-2130:2121-2130'
    volumes:
      - ./files:/tmp
      - .:/app
    image: fclairamb/ftpserver

docker-compose up -d

Test it

This is a quick way to see if it's working correctly:

# Download some file
[ -f kitty.jpg ] || (curl -o kitty.jpg.tmp https://placekitten.com/2048/2048 && mv kitty.jpg.tmp kitty.jpg)

# Upload it to the server
curl -v -T kitty.jpg ftp://test:test@localhost:2121/

# Download it back
curl ftp://test:test@localhost:2121/kitty.jpg -o kitty2.jpg

# Compare it
diff kitty.jpg kitty2.jpg

Config file

If you don't create a ftpserver.json file, one will be created for you.

Here is a sample config file:

…

You can generate the TLS key pair files with the following command:

openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out cert.pem -keyout key.pem

SFTP backend host key verification

The sftp backend connects to an upstream SSH/SFTP server and verifies its host key to protect against man-in-the-middle attacks. You must configure exactly one of the following params:

• known_hosts: path to an OpenSSH known_hosts file containing the upstream server's key (e.g. generated with ssh-keyscan -H host >> known_hosts).
• host_key: the upstream server's public key pinned inline, in authorized_keys / known_hosts line format (e.g. ssh-ed25519 AAAA...).
• insecure_ignore_host_key: set to "true" to disable host key verification entirely. This is unsafe (it exposes the connection to man-in-the-middle attacks) and should only be used in trusted networks or for testing.

If none of these is set, the connection is refused.