Managing file transfers securely and efficiently is a critical requirement for many organizations, especially when integrating cloud storage into existing workflows. When it comes to Oracle Cloud Infrastructure (OCI), the Object Storage service is widely used for its durability, scalability. It's a internet-scale, high-performance storage platform offered by OCI which is scalable, flexible and offers greater data durability and resiliency.
However, many applications and legacy systems still rely on SFTP for file transfers. In such cases it gets tricky to get the data files transferred between such legacy systems and the OCI cloud platform.
By combining OCI Object Storage with S3-compatible endpoints and a lightweight, open-source tool like SFTPGo, we can seamlessly enable SFTP access to our OCI Object Storage buckets without restructuring existing processes.
This article will explain step by step process on how to configure OCI Object Storage over SFTP using the S3 Compatibility API and SFTPGo, enabling secure, familiar file transfer workflows in a modern cloud environment.
High level steps:
1. Create Bucket and Enable S3 compatible API
2. Generate Client Secret keys
3. Provision SFTPGo on OCI instance
4. SFTPGo configurations
5. Test the OCI bucket connectivity over SFTP
Let's dive in.
1. Create Bucket and Enable S3 compatible API
- Navigate to the Tenancy details
- Once on Tenancy details page, note down the Compartment listed under Amazon S3 Compatibility API designated compartment as well as the Namespace of the Object Storage
If you wish to change the Amazon S3 compatible compartment, then you can do so by clicking 'Edit object storage settings' button and changing the S3 compatible compartment
- Let's create a new bucket in the above mentioned Compartment, as shown below. Let's name it
sftpbucket- Now that we've created a bucket under S3 compatible compartment, let's move on to step 2.
2. Generate Client Secret keys
- Navigate to profile and go to the User details page
- Go to Token and Keys section
- Scroll down to Customer Secret Keys section and click Generate secret key
- Give a relevant name to the key like sftogo and click Generate
- At this stage, it will generate the key and also show you the Secret.
Make sure to note the Secret down as it won't be displayed again after this stage.
- Also, note down the newly generated Key
3. Provision SFTPGo on OCI instance
- Navigate to Compute -> Instances
- Create a new instance (or you can use your existing instance)
- If you are creating a new instance then below references may help:
Placement: AD 1
Image: Oracle Linux 9
Shape: VM.Standard.A1.Flex
Shape build: Virtual machine, 1 core OCPU, 6 GB memory, 1 Gbps network bandwidth
- While provisioning new instance, you'll be given an option to generate Private-Public key pair. Download the Private key and store it on your machine.
- Once you enter the instance, navigate to Instance access section and note down the Public IP Address and username (usually
opc)
- Open command prompt on your machine
- Run below command
ssh -i <private key file path on your machine> opc@<public IP address)
- This will let us in the new instance, and you should see the shell prompt similar to this
- Now let's run below commands in the given sequence:
Create the SFTPGo repository:
ARCH=`uname -m`
curl -sS https://ftp.osuosl.org/pub/sftpgo/yum/${ARCH}/sftpgo.repo | sudo tee /etc/yum.repos.d/sftpgo.repo
Reload the package database and install SFTPGo:
sudo yum update
sudo yum install sftpgo
- At this stage we are done installing SFTPGo on our instance.
- Now, let's start the SFTPGo service and enable it to start at system boot:
sudo systemctl start sftpgo
sudo systemctl enable sftpgo
At this stage, we've started the SFTPGo server on our OCI instance.
SFTPGo server runs on the Public IP address of our instance and at the port 8080
Let's make sure we open this port in our firewall config.
Run this command to see the current firewall config
sudo firewall-cmd --list-all
Run below commands to add the port 8080 to firewall config and reload it
sudo firewall-cmd --add-port=<port_number>/tcp --permanent
sudo firewall-cmd --reload
At this stage we have completed all the configurations in installting and enabling SFTPGo on our OCI instance.
4. SFTPGo configurations
- SFTPGo WebUI is accessible at this URL: http://<Public IP of your Instance>:8080/web/admin
- Let's go to this URL in Chrome browser
- We'll be presented to configure Admin account upon accessing this URL first time
- Setup the Admin user name and Password and Save.
- Let's login to WebAdmin as the admin
- Once we login as Admin, we should see below page:
- Let's create a sftp user that will be used to access our Object Storage bucket
- Click Add
- Let's name our user
sftpgo_user and provide a strong password
- Scroll down to File system section and fill-in below details:
Storage: S3 (Compatible)
Bucket: Bucket name from OCI Object Storage obtained from Step 1
Region: Your OCI Region
Access Key and Access Secret: Obtained from Step 2
Optionally, you can mention Key Prefix if you want to restrict access to a particular folder in the bucket and not provide access to the whole bucket.
For example if your bucket has a folder named
SFTPFiles and you want SFTP User to have access only to this folder then you can mention
SFTPFiles/ in the Key Prefix.
Now, we need to enter S3 compatible endpoint of our namespace in which the bucket resides.
The syntax for compatible endpoint URL is:
https://{object-storage-namespace}.compat.objectstorage.{region}.oraclecloud.comSo your endpoint URL will look similar to this -
- Click Save to create the SFTP user
- Once created, the Admin can see the user and it's status on the Users page
- At this stage we've completed all the SFTPGO configurations
5. Test the OCI bucket connectivity over SFTP
- Let's login to WebClient as the
sftpgo_user
- On the Files page, we can either create a New Folder or Upload a new File
- Create a new folder names test
- Let's upload a test file as well
We will be able to see the new folder and the newly uploaded file on SFTPGo Web Client
- Now, let's navigate back to the OCI Object Storage bucket and see if these new objects are available there
As we can see, both the folder and the file are available on our bucket -
Conclusion:
By combining the power of OCI Object Storage with the flexibility of SFTPGo and the S3 Compatibility API, organizations can modernize their file transfer infrastructure without disrupting existing processes. This solution offers a secure, cost-effective, and scalable way to support SFTP workflows while taking full advantage of cloud storage. Whether you're migrating legacy systems or building hybrid environments, this approach bridges the gap between traditional file transfer needs and modern cloud capabilities.