Closed
Description
Is your feature request related to a problem? Please describe.
SourceIp
SFTP server connects to MinIO by using localhost address
minio/cmd/sftp-server-driver.go
Line 83 in 8b660e1
which why it is possible to use policy like this to allow access to buckets with S3 but prevent it from SFTP clients:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::*"
],
"Condition": {
"NotIpAddress": {
"aws:SourceIp": [
"127.0.0.1/32"
]
}
}
}
]
}UserAgent
UserAgent is currently hardcoded in Go SDK
which why it is possible to use policy like this to allow access to buckets with S3 but prevent it from SFTP clients:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::*"
],
"Condition": {
"StringNotLike": {
"aws:UserAgent": [
"MinIO *"
]
}
}
}
]
}Describe the solution you'd like
It would be nice if SFTP server would have own documented UserAgent which can be used to block SFTP connections.
Also would be nice if SourceIp would works same way that for S3 connections. It should be possible to to achieve it by setting SFTP client IP to header X-Forwarded-For when calling backend.