How to Setup an SFTP Server Using SFTPGo in Linux

What is SFTPGo?

SFTPGo is completely free, open source, and written in the Go programming language.

SFTPGo is a full-featured, highly configurable SFTP service that supports custom HTTP/S, FTP/S, and WebDAV. It supports local file systems, encrypted local file systems, S3 (compatible) object storage, Google Cloud Storage, Azure Blob storage, SFTP, and other storage forms.

Through SFTPGo, you can build a cloud storage server based on HTTP/S, FTP/S, and WebDAV SFTP file protocol, and when you create a user, you can perform a variety of custom configurations on the user's permissions, including restricting the access of visiting users IP address, bandwidth for uploading and downloading, specific file types that can be accessed, file protocols that can be used, secondary authentication, the maximum number of concurrent sessions, available disk quota… and other permission settings.

At the same time, users can easily share their files, and you can even set the maximum number of times a file can be accessed, and the file will not be accessible after the number of accesses is exceeded.

If you want to know the complete list of features and information, please see the project link: https://github.com/drakkan/sftpgo

This program is security-oriented and supports two-step-factor authentication. You heard it right, FTP can also use two-step factor authentication. Please see the picture:

This article is based on the Linux system and introduces readers to the installation and use of this service.

list of the supported platforms:

Linux, Windows, macOS, and FreeBSD. It also works with Docker, AWS cloud, Azure cloud and Elestio software services provider platforms and if you want to you can even install on some BSD variants too.

Install SFTPGo on different Linux Distributions

Install SFTPGo on Arch-based Linux

In Arch Linux and its variants such as Manjaro Linux, you can install SFTPGo from AUR by using:

Yay

#!/bin/bash
yay -S sftpgo

Paru

paru -S sftpgo

Install SFTPGo on Debian-based Linux

In Debian 10 or 11, we are using the SFTPGo APT repository from osuosl.org and installing SFTPGo as shown below:

First of all, we need to make sure that our system has the updated version of the repository and installed gnupg for importing the public GPG key by using the below command:

sudo apt update -y && sudo apt install gnupg -y

Next, we will import the public GPG key:

curl -sS https://ftp.osuosl.org/pub/sftpgo/apt/gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/sftpgo-archive-keyring.gpg

Then we will set an environment code name for our Debian distribution and add the SFTPGo repository to a new /etc/apt/sources.list.d/sftpgo.list file:

CODENAME=`lsb_release -c -s`

echo "deb [signed-by=/usr/share/keyrings/sftpgo-archive-keyring.gpg] https://ftp.osuosl.org/pub/sftpgo/apt ${CODENAME} main" | sudo tee /etc/apt/sources.list.d/sftpgo.list

Finally, we can install it by updating and installing commands:

sudo apt update && sudo apt install sftpgo

Install SFTPGo on Ubuntu-based Linux

SFTPGo PPA repository is available for Ubuntu, Kubuntu, Pop OS, Linux Mint and Elementary OS, Zorin OS, etc, we can add by using the following command:

 sudo add-apt-repository ppa:sftpgo/sftpgo

Update the repository lists and install SFTPGo:

 sudo apt update && sudo apt install sftpgo

Install SFTPGo on RedHat-based Linux

First, add SFTPGo repository:

ARCH=`uname -m`

curl -sS https://ftp.osuosl.org/pub/sftpgo/yum/${ARCH}/sftpgo.repo | sudo tee /etc/yum.repos.d/sftpgo.repoARCH=`uname -m`

And then we can use RPM-based system command to update repository lists and install the package:

sudo dnf update -y && sudo dnf install sftpgo -y

After installing the program, we can start and enable the sftpgo systemd service:

sudo systemctl start sftpgo && sudo systemctl enable sftpgo

Install SFTPGo on Void Linux:

By default, SFTPgo is already available in default void Linux repositories, so we just need to use the package manager to update the repositories and install the package:

sudo xbps-install sftpgo && sudo xbps-install -S

Configuration

Secure SFTPGO web interface with a self-signed certificate:

By default, this FTPGo server did not offer any encryption in the web interface, If this is the first time you set up an admin account, I suggest you first configure the TLS settings of this server and then start the service to create an administrator account, so that if you are doing it remotely, no one can intercept and get the password. Additionally, you can also use Let's Encrypt to do that, more about it here.

First, ensure OpenSSL is installed, we need OpenSSL to create a self-signed certificate.

##On Debian/ubuntu

sudo apt install openssl


##On RHEL/CentOS/Rocky Linux/Alma Linux


sudo yum install openssl

Once OpenSSL is installed, issue certificates as below and provide the details to create the key.

sudo openssl req -x509 -nodes -days 2920 -newkey rsa:2048 -keyout /etc/sftpgo.pem -out /etc/sftpgo/sftpgo.pem

Next, set the required permissions:

sudo chmod 755 /etc/sftpgo/sftpgo.pem
sudo chmod 755 /etc/sftpgo.pem

Once the keys are created, add the keys to the JSON configuration file as below:

sudo nano /etc/sftpgo/sftpgo.json

Change "enable_https": from false to true and add the file path to "certificate_file": and "certificate_key_file": as shown below:

......
......
  "httpd": {
    "bindings": [
      {
        "port": 8080,
        "address": "",
        "enable_web_admin": true,
        "enable_web_client": true,
        "enable_rest_api": true,
        "enabled_login_methods": 0,
        "enable_https": true,
        "certificate_file": "",
        "certificate_key_file": "",
        "min_tls_version": 12,
........
........

            "default_css": "",
            "extra_css": []
          }
        }
      }
    ],

    "templates_path": "templates",
    "static_files_path": "static",
    "openapi_path": "openapi",
    "web_root": "",
    "certificate_file": "/etc/sftpgo/sftpgo.pem",
    "certificate_key_file": "/etc/sftpgo.pem",
    "ca_certificates": [],
    "ca_revocation_lists": [],
......
......

Save the file and restart SFTPGo service, If you don't get any settings errors it means your configuration was successful.

sudo systemctl restart sftpgo

Create an Admin Account in the web interface:

Before starting to use SFTPGo, first create an administrator account. Please navigate to the https://Server_IP-address:8080/web/admin URL from your web browser.

Enter a username and enter a strong password and click "Create admin" to create an account:

After creating an administrator account, you will be automatically logged in. This is the SFTTPGo Admin Dashboard:

Here you can create more user accounts and set their passwords, including some settings you want to customize, and you can see all the statuses.

You can view the active services by adding /status in https://Server_IP-address:8080/web/admin URL or clicking from the left pane, as you can see, the default configuration enables the SFTP service on port 2022 and uses data provider SQLite. For security reasons, some of the insecure protocols such as FTP and WebDAV services are disabled by default:

Enable FTP and WebDAV services (Optional)

If you need to utilize FTP or WebDAV for any reason, only enable them within your trusted local area network or for public file sharing. If you still want to enable those protocols, please see the following configuration:

Create an environment variable file for FTP at /etc/sftpgo/env.d/ftp-port.env with the following text to enable FTP service:

#!/bin/bash
sudo nano /etc/sftpgo/env.d/ftp-port.env

Add the following content:

SFTPGO_FTPD__BINDINGS__0__PORT=21

Save the changes and restart SFTPGo service to apply the changes.

#!/bin/bash
sudo systemctl restart sftpgo

The SFTPGo is listening on Port 21, it also needs the passive port range allowed in the firewall to make it work, log back into the web interface; and find the passive port range in the "status" panel, such as 50000 to 50100 TCP ports.

Similar to above, create a WebDAV environment variable file at /etc/sftpgo/env.d/webDAV-port.env with the following information to enable WebDAV service:

#!/bin/bash
sudo nano /etc/sftpgo/env.d/webDAV-port.env

Add the following content:

it's normally using port 80 if any other program is using port 80, you can specify another port too

SFTPGO_WEBDAVD__BINDINGS__0__PORT=80

Save the changes and restart SFTPGo service to apply the changes.

#!/bin/bash
sudo systemctl restart sftpgo

The SFTPGo is listening on Port 80, and make sure to create a firewall rule to allow traffic through.

To expose FTP and WebDAV via TLS, it is also possible to configure certificates would particular services.

Finally, log into the web interface, then make sure checks all the services are running.

Access by the Client:

We may use the command line, built-in web interface, or any third-party SFTP client program to upload and download files and folders.

Access Files via SFTPGo Web Client

If users have been created, they may access their files and shares using the WebClient interface, which is accessible via the URL https://Server_IP-address:8080/web/client. We can enter the username and password and click the Login button to manage your user files and the user content.

Access SFTP via Commandline

Connect to the SFTP server from Terminal (Windows PowerShell, Linux bash, etc), in this case, 2022 is the port number:

sftp -P 2022 MYUSER@IPaddressORDomain

After typing in the user password we will be entered in the SFTP shell, the command, and the use case is the same as FTP. Some basic command is as follow:

`help`	Lists all `ftp` commands or, if a command name is supplied, briefly describes what the command does.
`reset`	Re-synchronizes the command-reply sequencing with the remote `ftp` server.
`ls`	Lists the contents of the remote working directory.
`pwd`	Displays the name of the remote working directory.
`cd`	Changes the remote working directory.
`lcd`	Changes the local working directory.
`mkdir`	Creates a directory on the remote system.
`rmdir`	Deletes a directory on the remote system.
`get, mget`	Copies a file (or multiple files) from the remote working directory to the local working directory.
`put, mput`	Copies a file (or multiple files) from the local working directory to the remote working directory.
`delete, mdelete`	Deletes a file (or multiple files) from the remote working directory.
`bye`	Quits the `ftp` command interpreter.

Source: Oracle docs

Access SFTP/FTP via FileZilla Client

If you don't have FileZilla installed, you can download it from the official website: https://filezilla-project.org/download.php
After installing FileZilla, open the application. Click on "File" in the top left corner and select "Site Manager" from the dropdown menu.
In the Site Manager, click on the "New Site" button and give your site a name.
Option 1 (For SFTP): Choose "SFTP - SSH File Transfer Protocol" as the protocol. For "Logon Type," select "Normal." Option 2 (For FTP): Choose "FTP - File Transfer Protocol" as the protocol. And choose "Use explicit FTP over TLS if available" for Encryption.
Under the "Host" field, enter the hostname or IP address of your SFTP server, and enter the right port number for the protocol setting, such as port 2022 for SFTP and port 21 for FTP.
For "Logon Type," select "Normal." If you want, you can enter the user and password now.
Click on the "Connect" button. FileZilla will use the settings you entered to establish a connection to your server.

An example of an SFTP setting

WebDAV client access:

For Windows user's access, we can use a WinSCP client to access WebDAV, like FileZilla, WinSCP also supports SFTP, FTP, and other protocols.

Download and install WinSCP from the official website.
Open WinSCP after installation.
Click on "Session" in the menu and select "Site Manager."
Click on "New Site" and choose the "WebDAV" protocol.
Enter the WebDAV server URL (start with http:// or https://) in the "Host name" field.
Choose the appropriate authentication method (username/password) and enter your WebDAV credentials.
In the "Advanced" tab, under "HTTP/WebDAV," enter the path to the WebDAV directory (if required by the server).
Click "OK" to save the site settings, then click "Connect" to establish the WebDAV connection.
Once connected, you can navigate the WebDAV server's folders and transfer files like you would with FileZilla.

For Linux users or those who prefer doing it in the command line, "cadaver" is the name of the command line WebDAV client. It may be used to do different WebDAV server tasks such as uploading, downloading, and deleting data. It can also create and remove folders, as well as lock and unlock files. You must first install Cadaver before you can use it. You may accomplish this on Debian and Ubuntu systems by using the following command:

#!/bin/bash
sudo apt-get install cadaver

Once cadaver is installed, you can start it by running the following command: (The cadaver prompt will look like this: cadaver>)

cadaver

The cadaver command line syntax is similar to the FTP command line syntax. Both cadaver and FTP allow users to connect to remote servers, upload and download files, and create and delete directories. However, The commands and syntax for these two tools are not completely the same, as they are meant for different protocols (WebDAV vs. FTP).

Summary

So, there you have it—the initial steps to set up SFTPGo. It's important to remember that what we've covered is just the starting point. The world of SFTPGo is vast, and while we've provided a basic configuration guide, things can quickly become more intricate. This software boasts a wide array of powerful features, tailored to various needs. Keep in mind that as you explore further, you'll discover a plethora of advanced configurations and setups that cater to specific requirements. This is just the tip of the iceberg, and the possibilities are vast.