Changing FTP settings will directly impact the levels of access to the file system on your cluster. Please consider your system environment and workflow processes before enabling this feature.
IN THIS ARTICLE
Outlines how to configure FTP in Qumulo Core using the qq CLI or the Web UI
- Cluster running Qumulo Core version 2.7.5 or above
- Command-Line tools installed
The FTP feature can be enabled via the Web UI or the qq CLI (it is disabled by default). Once enabled, all users will have FTP access to the entire file system of your cluster. Configuring specific fields and features for the FTP must be done via the qq CLI and is not supported on the read-only FTP page.
Enable FTP via the Web UI
- Login to the Web UI.
- Hover over the Sharing menu and click FTP.
- Toggle the Enabled button to ON to enable FTP.
To disable FTP in the UI, toggle the Enabled button to OFF. Refer to the instructions below to configure FTP using the qq CLI.
Enable FTP via the qq CLI
- Enable FTP with the following command:
qq ftp_modify_settings --enabled true
- Disable FTP by running the following:
qq ftp_modify_settings --enabled false
- With FTP, you can allow FXP (server-to-server transfer) using the command below.
- Keep in mind that using FXP can make your server vulnerable to an FTP bounce. Review the article on File eXchange Protocol for additional details on risks and benefits.
qq ftp_modify_settings --check-remote-host false
Monitor FTP via the qq CLI
Once FTP is enabled, you can check server status and settings by utilizing the following command:
Enable Anonymous Users for FTP
An anonymous user can be enabled and mapped to a local user with version 2.8.5 or above of Qumulo Core. Use the guest account or input the name of the local user in place of guest as outlined with the command below:
qq ftp_modify_settings --anonymous-user-as-local-user guest
To disable the anonymous user and return to default behavior, run the following command:
qq ftp_modify_settings --anonymous-user-none
Active Directory Users for FTP
An Active Directory user can connect to the cluster running Qumulo Core 2.8.6 or above. For example, a user would log in using the DOMAIN\\username syntax as outlined below:
computer:~$ ftp cluster.company.com
Connected to cluster.company.com
| _ | | |
| | | |_ _ _ __ ___ _ _| | ___
| | | | | | | '_ ` _ \| | | | |/ _ \
\ \/' | |_| | | | | | | |_| | | (_) |
\_/\_\\__,_|_| |_| |_|\__,_|_|\___/
| ___|_ _| ___ \
| |_ | | | |_/ /
| _| | | | __/
| | | | | |
\_| \_/ \_|
220 Qumulo FTP server ready.
Name (cluster:computer): DOMAIN\\username
331 Password required.
230 Login succeeded
Remote system type is UNIX.
Using binary mode to transfer files.
Set the User's Home Directory
Qumulo supports setting the home directory for local or Active Directory users via the qq command line . Once this setting is enabled, the user will start in their home directory instead of in the root of the cluster.
To set the local user's home directory, run the following command:
qq auth_mod_user --id localusername --home-directory /home/localusername
To set the AD user's home directory (Qumulo Core 2.13.3 or above), run the command below:
qq identity_attributes_set adusername --home-directory /home/adusername
Note that the user will require traverse rights from the root of the cluster to successfully land in their home directory as outlined above. If the user does not have traverse rights, they will abide by the default behavior and land in the root of the cluster.
Local Users for FTP
If you wish to simply create FTP access for local users (rather than using Active Directory), you can follow the steps in this section.
Use the auth_mod_user command as detailed in the previous section to configure the local user's home directory. Then create an FTP directory in the path specified with the following command:
qq fs_create_dir --path DIRECTORY_PATH --name DIRECTORY_NAME
admin@qumulotest:~$ qq fs_create_dir --path / --name FTP
Grant the user account permission to access the new directory with the following command:
qq fs_modify_acl --path DIRECTORY_PATH add_entry -t local:USER -y Allowed -r Read, Write directory, Delete child, Execute/Traverse
admin@qumulotest:~$ qq fs_modify_acl --path /FTP add_entry -t local:ftp-user -y Allowed -r Read, Write directory, Delete child, Execute/Traverse
ID Trustee Type Flags Rights
== ============== ======= ===== ================================================
1 local:admin Allowed Delete child, Execute/Traverse, Read, Write file
2 local:Users Allowed Execute/Traverse, Read
3 Everyone Allowed Execute/Traverse, Read
4 local:ftp-user Allowed Delete child, Execute/Traverse, Read, Write file
Admins can optionally change the root directory for users to their home directories when they connect via FTP by using the following command in version 2.8.6 or above of Qumulo Core:
qq ftp_modify_settings --chroot-users true
To disable and return to default behavior, run the following command:
qq ftp_modify_settings --chroot-users false
As specified above, if you are configuring a local user, the user will require traverse rights from the root of the cluster to their home directory to successfully connect.
You should now be able to successfully configure and utilize FTP in Qumulo Core
Like what you see? Share this article with your network!