sftp

A fast and secure SFTP server that runs in a container on Alpine Linux, optimised for Kubernetes.

Usage

Configuration parameters are passed in to the container through environment variables. All variables are optional so that you can run a container with minimum configuration. The simples way of running using Docker is by using the following command.

$ docker run -p 22:22 -e SSH_PASSWORD=notsecure amimof/sftp:latest

Note that even though the username defaults to sftpuser, we still need to specify a password. All though it's not required, but the container wont do you much good without one.

Environment Variables

Variable	Default Value	Description
`SSH_USERNAME`	`sftpuser`	Username of the sftp user
`SSH_PASSWORD`	-	A password for the user. Setting this environment variable will allow `PasswordAuthentication`.
`SSH_USERID`	`1337`	The Linux user id of the sftp user
`SSH_DATADIR_NAME`	`data`	Name of the directory created under `/home/<username>/`. Defaults to `/home/<username>/data/`
`SSH_GENERATE_HOSTKEYS`	`true`	Skips generation if host keys of set to false. Useful when providing your own set of host keys.
`LOG_LEVEL`	`INFO`	Use this environment variable to set the `LogLevel` directive in `sshd_config`
`DEBUG`	`false`	Set to `true` to start `sshd` in debug mode. `sshd -d`

Examples

Username & password authentication

$ docker run \
    -p 22:22 \
    -e SSH_USERNAME=sftpuser \
    -e SSH_PASSWORD=notsecure \
    amimof/sftp:latest

SSH key authentication

$ docker run \
    -p 22:22 \
    -e SSH_USERNAME=sftpuser \
    -v ~/.ssh/id_rsa.pub:/home/sftpuser/.ssh/keys/id_rsa.pub \
    amimof/sftp:latest

Specify SSH host keys

SSH host keys will be automatically generated and change between container restarts unless specified otherwise with the SSH_GENERATE_HOSTKEYS environment variable. To avoid man-in-the-middle attack warnings you can mount your own host keys into the container.

$ docker run \
    -p 22:22 \
    -e SSH_USERNAME=sftpuser \
    -e SSH_PASSWORD=notsecure \
    -e SSH_GENERATE_HOSTKEYS=false \
    -v ~/ssh_host_ed25519_key:/etc/ssh/host_keys/ssh_host_ed25519_key \
    -v ~/ssh_host_rsa_key:/etc/ssh/host_keys/ssh_host_rsa_key \
    amimof/sftp:latest

NOTE! The host keys are placed in the non-default location of /etc/ssh/host_keys/ so that you can mount your host keys using a Kubernetes Secret. If the secret is mounted on the host key's default location, /etc/ssh/, all other files in that directory would be overwritten, including sshd_config which would prevent the ssh server from starting correctly.

Specify SSH Host Keys and use key authentication

$ docker run \
    -p 22:22 \
    -e SSH_USERNAME=sftpuser \
    -e SSH_GENERATE_HOSTKEYS=false \
    -v ~/.ssh/id_rsa.pub:/home/sftpuser/.ssh/keys/id_rsa.pub \
    -v ~/ssh_host_ed25519_key:/etc/ssh/host_keys/ssh_host_ed25519_key \
    -v ~/ssh_host_rsa_key:/etc/ssh/host_keys/ssh_host_rsa_key \
    amimof/sftp:latest

Generating keys

# rsa
ssh-keygen -t rsa -b 4096 -f ~/mykeys/ssh_host_rsa_key

# dsa
ssh-keygen -t dsa -f ~/mykeys/ssh_host_dsa_key

# ecdsa
ssh-keygen -t ecdsa -f ~/mykeys/ssh_host_ecdsa_key

# ed25519
ssh-keygen -t ed25519 -f ~/mykeys/ssh_host_ed25519_key

rshaikh/sftp