FTP and SFTP

MinIO can expose its object store as FTP/FTPS and SFTP. The implementations live in cmd/ftp-server*.go and cmd/sftp-server*.go and share a virtual-filesystem driver that maps FTP path operations to S3 verbs.

Purpose

Let legacy clients (cameras, scientific instruments, embedded devices) push files into MinIO without an S3 SDK.

Layout

cmd/
├── ftp-server.go             # Boot / config for goftp.io/server/v2
├── ftp-server-driver.go      # The S3-backed FTP driver
├── sftp-server.go            # Boot / config for pkg/sftp
└── sftp-server-driver.go     # The S3-backed SFTP driver

Key abstractions

Symbol	File	What it is
ftpDriver	cmd/ftp-server-driver.go	Implements the goftp driver interface against objectAPI.
sftpDriver	cmd/sftp-server-driver.go	Implements the SSH/SFTP server interface.
ftp-server/sftp-server boot	respective *.go	Reads the --ftp / --sftp flags and starts the listener.

How it works

graph LR
    CLI[FTP/SFTP client] --> SRV[FTP server / SSH server]
    SRV --> DRV[ftpDriver / sftpDriver]
    DRV --> OBJ[ObjectLayer]
    OBJ --> EC[Erasure-coded backend]

• --ftp="address=:8021" --ftp="passive-port-range=30000-40000" and similar --sftp=... flags define listeners.
• Authentication uses MinIO's IAM: clients log in with their <accessKey> as the username and the <secretKey> as the password (or with an SSH key authorised in IAM).
• Path semantics: /<bucket>/<object> — top-level directories are buckets, files inside them are objects.
• Multipart-style uploads aren't exposed: an FTP/SFTP STOR becomes a single PUT to MinIO.

Limitations

• No range PUT (FTP APPE is not supported in a way that preserves S3 semantics).
• Anonymous logins are off by default; set up via the policy_anonymous IAM toggle.
• Some FTP clients expect file timestamps; the driver reports the object's last-modified time.

Integration points

• IAM (cmd/iam.go) for authentication.
• ObjectLayer for every read/write.
• TLS uses the shared cluster certs (internal/config/identity/tls/).

Entry points for modification

• New auth mechanism. Extend the credential resolver in the relevant driver file. Best to keep IAM as the single source of truth.
• New path semantic. Touch only the driver; don't rewrite the FTP/SSH library.
• TLS / SSH key handling. The certs come from the same loader as the main HTTP server (cmd/server-main.go).