Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Improve SourceIp and UserAgent usability for SFTP connections. #19698

Closed
olljanat opened this issue May 8, 2024 · 2 comments
Closed

feat: Improve SourceIp and UserAgent usability for SFTP connections. #19698

olljanat opened this issue May 8, 2024 · 2 comments
Labels
community triage

Comments

@olljanat
Copy link
Contributor

olljanat commented May 8, 2024

Is your feature request related to a problem? Please describe.

SourceIp

SFTP server connects to MinIO by using localhost address

minio/cmd/sftp-server-driver.go

Line 83 in 8b660e1

handler := &sftpDriver{endpoint: fmt.Sprintf("127.0.0.1:%s", globalMinioPort), permissions: perms}

which why it is possible to use policy like this to allow access to buckets with S3 but prevent it from SFTP clients:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ],
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "127.0.0.1/32"
                    ]
                }
            }
        }
    ]
}

UserAgent

UserAgent is currently hardcoded in Go SDK
which why it is possible to use policy like this to allow access to buckets with S3 but prevent it from SFTP clients:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ],
            "Condition": {
                "StringNotLike": {
                    "aws:UserAgent": [
                        "MinIO *"
                    ]
                }
            }
        }
    ]
}

Describe the solution you'd like
It would be nice if SFTP server would have own documented UserAgent which can be used to block SFTP connections.
Also would be nice if SourceIp would works same way that for S3 connections. It should be possible to to achieve it by setting SFTP client IP to header X-Forwarded-For when calling backend.

Describe alternatives you've considered

Additional context
@klauspost
Copy link
Contributor

We do not have any plans for this.

You are welcome to submit a PR or reach out to sales@min.io to engage commercially and we can evaluate it in that context.

@olljanat
Copy link
Contributor Author

olljanat commented May 9, 2024 •
edited

@klauspost OK, I can create PR but perhaps you still want to comment about right way to implement this?

I was thinking to set CustomRequestHeaders in here? (and support for it in minio-go side)

minio/cmd/sftp-server-driver.go

Lines 156 to 160 in 9a267f9

return minio.New(f.endpoint, &minio.Options{
Creds: mcreds,
Secure: globalIsTLS,
Transport: globalRemoteFTPClientTransport,
})

Values would be something like MinIO SFTP Server in user agent and ssh.ConnMetadata.RemoteAddr() (which should contain client IP) in X-Forwarded-For header.

Context is ability to have MinIO's SFTP server published to internet but block those connections from everyone else than whitelisted sources.

This was referenced May 15, 2024
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
community triage
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

WIP: SFTP: Pass client version and source IP to backend olljanat/minio
2 participants
@klauspost @olljanat