How to Deploy SFTPGo as an Azure Storage SFTP Alternative

Azure Storage SFTP is Microsoft's managed file transfer service built on Azure Blob Storage that provides SFTP endpoint access to cloud storage containers. It abstracts server management but ties teams to continuous hourly endpoint charges, Azure AD authentication, and Microsoft's storage ecosystem.

SFTPGo is an open-source file transfer server that provides SFTP, FTP/S, and WebDAV with native Azure Blob Storage support, web-based user management, and flexible authentication. It delivers the same file transfer capabilities on any infrastructure without continuous hourly charges or cloud provider lock-in.

This article explains how to deploy SFTPGo as a self-hosted alternative to Azure Storage SFTP using Docker Compose with Traefik for automatic HTTPS. It covers user authentication, Azure Blob Storage backend configuration, multi-protocol access (SFTP, FTP/S, WebDAV), and migration strategies from Azure Storage SFTP.

Understanding SFTPGo Architecture

SFTPGo maps directly to Azure Storage SFTP features while providing additional flexibility. The following table compares Azure Storage SFTP components with their SFTPGo equivalents:

Key components of SFTPGo include:

• Protocol Handlers: Listeners for SFTP (port 2022), FTP/S (port 2121), and WebDAV (port 10080)
• Web Admin Interface: Browser-based dashboard on port 8080 for configuration and monitoring
• Data Provider: SQLite, MySQL, or PostgreSQL database for storing user and configuration data
• Storage Backends: Pluggable layer supporting local filesystem, Azure Blob Storage, S3-compatible storage (including Vultr Object Storage), and Google Cloud Storage

Prerequisites

Before you begin, you need to:

• Have access to a Linux-based server as a non-root user with sudo privileges.
• Install Docker and Docker Compose.
• Create a DNS A record pointing to your server's IP address (for example, sftp.example.com).
• (Optional) Have an Azure Storage account with SFTP enabled if migrating from Azure Storage SFTP.

Deploy SFTPGo with Docker Compose

The stack consists of two containers: SFTPGo handles file transfer and user management, and Traefik acts as a reverse proxy that provisions a Let's Encrypt TLS certificate and routes HTTPS traffic to the SFTPGo admin interface on port 8080. Deploying Traefik from the start ensures that all credentials and configuration data transit over TLS from the first request.

1. Create the project directory with subdirectories for data and configuration persistence.

   CONSOLE

   Copy

   $ mkdir -p ~/sftpgo/{data,config}

   Explain Code

   Powered by Vultr AgentBeta
   • data: Stores user files served over SFTP.
   • config: Holds SFTPGo configuration and the SQLite database.

2. Switch to the project directory.

   CONSOLE

   Copy

   $ cd ~/sftpgo

   Explain Code

   Powered by Vultr AgentBeta

3. Create an environment file for domain configuration. Replace sftp.example.com with your domain and admin@example.com with your email address for Let's Encrypt notifications.

   CONSOLE

   Copy

   $ nano .env

   Explain Code

   Powered by Vultr AgentBeta

4. Add the following variables:

   INI

   Copy

   DOMAIN=sftp.example.com
   LETSENCRYPT_EMAIL=admin@example.com

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

5. Create the Docker Compose configuration file.

   CONSOLE

   Copy

   $ nano docker-compose.yml

   Explain Code

   Powered by Vultr AgentBeta

6. Add the following service definition:

   YAML

   Copy

   services:
     traefik:
       image: traefik:v3.6
       container_name: traefik
       command:
         - "--providers.docker=true"
         - "--providers.docker.exposedbydefault=false"
         - "--entrypoints.web.address=:80"
         - "--entrypoints.websecure.address=:443"
         - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
         - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
         - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
         - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
         - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
       ports:
         - "80:80"
         - "443:443"
       volumes:
         - "letsencrypt:/letsencrypt"
         - "/var/run/docker.sock:/var/run/docker.sock:ro"
       restart: unless-stopped
   
     sftpgo:
       image: drakkan/sftpgo:v2.7
       container_name: sftpgo
       restart: unless-stopped
       ports:
         - "2022:2022"
         - "2121:2121"
         - "10080:10080"
       environment:
         - SFTPGO_HTTPD__BINDINGS__0__PORT=8080
         - SFTPGO_HTTPD__BINDINGS__0__ADDRESS=0.0.0.0
         - SFTPGO_SFTPD__BINDINGS__0__PORT=2022
         - SFTPGO_FTPD__BINDINGS__0__PORT=2121
         - SFTPGO_WEBDAVD__BINDINGS__0__PORT=10080
         - SFTPGO_DATA_PROVIDER__DRIVER=sqlite
         - SFTPGO_DATA_PROVIDER__NAME=/var/lib/sftpgo/sftpgo.db
       volumes:
         - ./data:/srv/sftpgo
         - ./config:/var/lib/sftpgo
       labels:
         - "traefik.enable=true"
         - "traefik.http.routers.sftpgo.rule=Host(`${DOMAIN}`)"
         - "traefik.http.routers.sftpgo.entrypoints=websecure"
         - "traefik.http.routers.sftpgo.tls.certresolver=letsencrypt"
         - "traefik.http.services.sftpgo.loadbalancer.server.port=8080"
       healthcheck:
         test: ["CMD", "sftpgo", "ping", "-c", "/var/lib/sftpgo"]
         interval: 30s
         timeout: 10s
         retries: 3
   
   volumes:
     letsencrypt:

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

   This configuration exposes:

   • Port 80/443: Traefik handles HTTP-to-HTTPS redirection and TLS termination for the web admin interface
   • Port 2022: SFTP protocol
   • Port 2121: FTP/S protocol
   • Port 10080: WebDAV protocol

   The web admin interface on port 8080 is not exposed directly to the host. Traefik proxies requests to it internally over the Docker network.

7. Launch the stack.

   CONSOLE

   Copy

   $ docker compose up -d

   Explain Code

   Powered by Vultr AgentBeta

8. Confirm all containers are running and healthy.

   CONSOLE

   Copy

   $ docker compose ps

   Explain Code

   Powered by Vultr AgentBeta

9. Review the container logs to verify that no startup errors occurred.

   CONSOLE

   Copy

   $ docker compose logs

   Explain Code

   Powered by Vultr AgentBeta

   For more information on managing a Docker Compose stack, see the How To Use Docker Compose article.

Configure SFTPGo Server

The web-based administration interface handles initial setup and ongoing server configuration.

1. Open a web browser and navigate to https://sftp.example.com/web/admin, replacing sftp.example.com with your configured domain.

   

2. Create an administrator account on first access:

   • Enter a username (for example, admin)
   • Set a strong password
   • Confirm the password in the Confirm password field
   • Click Create admin and Sign in

   The dashboard loads.

   

3. Navigate to Server Manager > Configurations in the sidebar to review default settings.

4. Review the SFTP, ACME, and SMTP sections to confirm that the default configuration matches your requirements.

Set Up User Authentication

SFTPGo supports password authentication, SSH public keys, and multi-factor authentication. Azure Storage SFTP local users can be recreated with equivalent access controls.

Create an SFTP User

1. Navigate to Users in the sidebar.

2. Click Add to create a new user.

   

3. Configure the account settings:

   • Username: Enter the SFTP username
   • Password: Set a strong password
   • Under Profile, set Status to Active

4. Under File system, keep Local disk selected for local storage.

5. Set the Root directory to /srv/sftpgo/USERNAME, replacing USERNAME with the SFTP username configured in the previous step.

6. Click Save.

Configure SSH Key Authentication

SSH keys provide passwordless authentication similar to Azure Storage SFTP's SSH key support.

1. Generate an SSH key pair on the client machine if one does not exist.

   CONSOLE

   Copy

   $ ssh-keygen -t ed25519 -f ~/.ssh/sftpgo_key -C "sftp-user"

   Explain Code

   Powered by Vultr AgentBeta

   When prompted for a passphrase, press Enter twice to create the key without a passphrase for passwordless authentication.

2. Display the public key.

   CONSOLE

   Copy

   $ cat ~/.ssh/sftpgo_key.pub

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGx... sftp-user

3. In the SFTPGo web interface, navigate to Users, click Actions next to the target user, and select Edit.

4. Locate the Public keys section.

5. Paste the public key string into the text field.

6. Click Save.

7. Test key-based authentication from the client. Replace USERNAME with your SFTPGo username.

   CONSOLE

   Copy

   $ sftp -i ~/.ssh/sftpgo_key -P 2022 USERNAME@sftp.example.com

   Explain Code

   Powered by Vultr AgentBeta

Enable Multi-Factor Authentication

1. Navigate to Users, click Actions next to the target user, and select Edit.

2. Expand the ACLs section and locate Require 2FA for.

3. Select the protocols requiring two-factor authentication.

4. Click Save.

   The user configures their authenticator app on next login via the WebClient portal.

Configure Storage Backends

SFTPGo supports local storage and S3-compatible object storage.

Configure Local Filesystem Storage

Local storage is the default backend. Files are stored under /srv/sftpgo/data/USERNAME/.

1. Navigate to Users, click Actions next to the target user, and select Edit.

2. Under File system, verify that Local disk is selected in the Storage dropdown.

3. Set the Root directory to /srv/sftpgo/USERNAME, replacing USERNAME with the SFTP username.

4. Click Save.

Configure S3-Compatible Object Storage

SFTPGo supports any S3-compatible storage service as a user backend, including MinIO and Vultr Object Storage.

1. Gather the following credentials from your S3-compatible storage provider:

   • Endpoint URL (for example, https://ewr1.vultrobjects.com).
   • Access Key.
   • Secret Key.
   • Bucket name.

2. In the SFTPGo web interface, navigate to Users, click Actions next to the target user, and select Edit.

3. Under File system, select S3 (Compatible) from the Storage dropdown.

   

4. Fill in the S3 backend fields:

   • Bucket: Enter your bucket name.
   • Region: Enter the region code (for example, ewr1).
   • Access Key: Enter your access key.
   • Access Secret: Enter your secret key.
   • Endpoint: Enter the full endpoint URL (for example, https://ewr1.vultrobjects.com).

5. Enable Use path-style addressing for S3-compatible endpoints.

6. Click Save.

7. Create a test file on the client machine.

   CONSOLE

   Copy

   $ echo "Hello SFTPGo" > testfile.txt

   Explain Code

   Powered by Vultr AgentBeta

8. Connect via SFTP to verify the configuration. Replace USERNAME with your SFTPGo username and sftp.example.com with your configured domain.

   CONSOLE

   Copy

   $ sftp -P 2022 USERNAME@sftp.example.com

   Explain Code

   Powered by Vultr AgentBeta

9. Upload the test file.

   CONSOLE

   Copy

   sftp> put testfile.txt

   Explain Code

   Powered by Vultr AgentBeta

10. Verify that the file appears in the bucket.

    CONSOLE

    Copy

    sftp> ls

    Explain Code

    Powered by Vultr AgentBeta

11. Close the SFTP session.

    CONSOLE

    Copy

    sftp> exit

    Explain Code

    Powered by Vultr AgentBeta

S3 Backend Limitations

S3-compatible backends have behavioral differences from local storage:

• Resume uploads are disabled by default.
• Symbolic links are not supported.
• Directory rename operations are not atomic.
• chmod and chown operations are silently ignored.

Set Up SFTP Access

SFTPGo runs SFTP on port 2022 by default and also supports FTP with TLS (FTP/S) and WebDAV for legacy clients and HTTP-based file access. Each protocol uses its own listener port and shares the same user accounts, authentication backends, and storage configuration.

Set Up Access Controls and Quotas

SFTPGo enforces quotas, bandwidth limits, IP restrictions, and per-directory permissions at the user level. Configure these controls to replicate Azure Storage SFTP access policies.

Configure User Quotas

1. Navigate to Users, click Actions next to the target user, and select Edit.

2. Expand the Disk quota and bandwidth limits section.

3. Configure quota settings:

   • Quota size: Maximum storage allocation. The field accepts values with size suffixes (for example, 10 GB or 500 MB).
   • Quota files: Maximum number of files

4. Click Save.

Configure Bandwidth Limits

1. Navigate to Users, click Actions next to the target user, and select Edit.

2. Expand the Disk quota and bandwidth limits section.

3. Set bandwidth restrictions:

   • Bandwidth UL (KB/s): Maximum upload speed in KB/s (for example, 5120 for 5 MB/s)
   • Bandwidth DL (KB/s): Maximum download speed in KB/s (for example, 5120 for 5 MB/s)

4. Click Save.

Configure IP Restrictions

1. Navigate to Users, click Actions next to the target user, and select Edit.

2. Expand the ACLs section and locate Allowed IP/Mask.

3. Add permitted IP addresses or CIDR ranges:

   192.168.1.0/24
   10.0.0.0/8

4. Optionally configure Denied IP/Mask to block specific addresses.

5. Click Save.

Configure Directory Permissions

1. Navigate to Users, click Actions next to the target user, and select Edit.

2. Expand the ACLs section and under Per-directory permissions, configure access:

   • Click Add to create a permission entry
   • Specify the Path (for example, /uploads)
   • Select allowed operations: List, Download, Upload, Delete, Rename, Create directories

3. Click Save.

Configure Event Notifications and Logging

Set up logging and event hooks to replace Azure Monitor integration.

Configure File Logging

1. Create a logs directory for persistent log storage.

   CONSOLE

   Copy

   $ mkdir -p ~/sftpgo/logs

   Explain Code

   Powered by Vultr AgentBeta

2. Open docker-compose.yml to add logging configuration.

   CONSOLE

   Copy

   $ nano ~/sftpgo/docker-compose.yml

   Explain Code

   Powered by Vultr AgentBeta

3. Append the logs volume to the existing volumes: block under the sftpgo service:

   YAML

   Copy

   - ./logs:/var/log/sftpgo

   Explain Code

   Powered by Vultr AgentBeta

4. Append the following logging environment variables to the existing environment: block under the sftpgo service:

   YAML

   Copy

   - SFTPGO_LOG_FILE_PATH=/var/log/sftpgo/sftpgo.log
   - SFTPGO_LOG_MAX_SIZE=10
   - SFTPGO_LOG_MAX_BACKUPS=5
   - SFTPGO_LOG_MAX_AGE=28
   - SFTPGO_LOG_LEVEL=info

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

5. Apply the updated configuration.

   CONSOLE

   Copy

   $ docker compose up -d

   Explain Code

   Powered by Vultr AgentBeta

Configure Event Hooks

SFTPGo supports HTTP webhooks for event notifications, replacing Azure Monitor alerts.

1. Navigate to Event Manager, then click Actions in the left sidebar.

2. Click Add to create a new action.

3. Configure the action:

   • Name: Enter an action name (for example, webhook-action).
   • Type: Select HTTP.
   • Server URL: Enter your webhook URL.
   • Method: Select POST.

4. Click Save.

5. Click Rules in the left sidebar.

   

6. Click Add to create a new event rule.

7. Configure the event trigger:

   • Name: Enter a descriptive name (for example, upload-notification).
   • Trigger: Select Filesystem events.
   • Fs events: Select upload.

8. Under Actions, select the previously created action.

9. Click Save.

Configure Syslog Integration

Forward logs to a centralized logging system as an alternative to Azure Monitor.

1. Open docker-compose.yml and add syslog configuration. Replace SYSLOG-SERVER with your syslog server address.

   CONSOLE

   Copy

   $ nano ~/sftpgo/docker-compose.yml

   Explain Code

   Powered by Vultr AgentBeta

2. Append the following environment variables to the existing environment: block under the sftpgo service:

   YAML

   Copy

   - SFTPGO_SYSLOG__ENABLED=true
   - SFTPGO_SYSLOG__ADDRESS=udp://SYSLOG-SERVER:514
   - SFTPGO_SYSLOG__FACILITY=local0

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

3. Apply the updated configuration.

   CONSOLE

   Copy

   $ docker compose up -d

   Explain Code

   Powered by Vultr AgentBeta

Test SFTP Connections

Verify the deployment by testing file transfer operations.

Test with Command-Line SFTP Client

1. Create a test file on the client machine.

   CONSOLE

   Copy

   $ echo "Hello SFTPGo" > testfile.txt

   Explain Code

   Powered by Vultr AgentBeta

2. Connect to the SFTP server. Replace USERNAME with your SFTPGo username.

   CONSOLE

   Copy

   $ sftp -P 2022 USERNAME@sftp.example.com

   Explain Code

   Powered by Vultr AgentBeta

3. Enter the password when prompted.

4. List directory contents.

   CONSOLE

   Copy

   sftp> ls -la

   Explain Code

   Powered by Vultr AgentBeta

5. Upload the test file.

   CONSOLE

   Copy

   sftp> put testfile.txt

   Explain Code

   Powered by Vultr AgentBeta

6. Download the file to verify.

   CONSOLE

   Copy

   sftp> get testfile.txt /tmp/testfile-downloaded.txt

   Explain Code

   Powered by Vultr AgentBeta

7. Exit the session.

   CONSOLE

   Copy

   sftp> exit

   Explain Code

   Powered by Vultr AgentBeta

Test with SSH Key Authentication

1. Connect using your private key. Replace USERNAME with your SFTPGo username.

   CONSOLE

   Copy

   $ sftp -i ~/.ssh/sftpgo_key -P 2022 USERNAME@sftp.example.com

   Explain Code

   Powered by Vultr AgentBeta

2. Verify that the connection is established without a password prompt.

3. Exit the session.

   CONSOLE

   Copy

   sftp> exit

   Explain Code

   Powered by Vultr AgentBeta

Test FTP/S Connection

1. Install an FTP client such as lftp.

   CONSOLE

   Copy

   $ sudo apt install lftp -y

   Explain Code

   Powered by Vultr AgentBeta

2. Connect with explicit TLS. Replace USERNAME with your FTP username.

   CONSOLE

   Copy

   $ lftp -u USERNAME -p 2121 ftp://sftp.example.com

   Explain Code

   Powered by Vultr AgentBeta

3. List files to verify the connection.

   CONSOLE

   Copy

   lftp> ls

   Explain Code

   Powered by Vultr AgentBeta

4. Exit the session.

   CONSOLE

   Copy

   lftp> exit

   Explain Code

   Powered by Vultr AgentBeta

Migrate from Azure Storage SFTP to SFTPGo

Migrating from Azure Storage SFTP requires recreating user accounts in SFTPGo, transferring stored data to the new storage backend, and updating client connection settings to point to the new server.

User Migration

Export local user configurations from Azure Storage and recreate them in SFTPGo.

1. List Azure Storage SFTP local users using the Azure CLI. Replace STORAGE-ACCOUNT with your storage account name and RESOURCE-GROUP with your resource group name.

   CONSOLE

   Copy

   $ az storage account local-user list --account-name STORAGE-ACCOUNT --resource-group RESOURCE-GROUP

   Explain Code

   Powered by Vultr AgentBeta

2. Export user details including SSH keys. Replace USERNAME with the local user name to export.

   CONSOLE

   Copy

   $ az storage account local-user show --account-name STORAGE-ACCOUNT --resource-group RESOURCE-GROUP --name USERNAME

   Explain Code

   Powered by Vultr AgentBeta

3. For each user, record:

   • Username
   • SSH public keys
   • Home directory (container and path)
   • Permission scope

4. Generate an API access token using your SFTPGo admin credentials. Replace ADMIN-USERNAME and ADMIN-PASSWORD with your SFTPGo admin credentials and sftp.example.com with your configured domain.

   CONSOLE

   Copy

   $ curl -u ADMIN-USERNAME:ADMIN-PASSWORD https://sftp.example.com/api/v2/token

   Explain Code

   Powered by Vultr AgentBeta

   The response contains an access_token value. The token expires after 15 minutes. Copy it and complete the next step before it expires.

5. Create the user via the REST API. Replace ACCESS-TOKEN with the token from the previous step.

   CONSOLE

   Copy

   $ curl -X POST "https://sftp.example.com/api/v2/users" \
       -H "Authorization: Bearer ACCESS-TOKEN" \
       -H "Content-Type: application/json" \
       -d '{
         "username": "USERNAME",
         "password": "PASSWORD",
         "status": 1,
         "public_keys": ["SSH-PUBLIC-KEY"],
         "home_dir": "/srv/sftpgo/data/USERNAME",
         "permissions": {"/": ["*"]}
       }'

   Explain Code

   Powered by Vultr AgentBeta

   Replace:

   • sftp.example.com with your configured domain.
   • USERNAME with the migrated SFTP username.
   • PASSWORD with a strong password for the user.
   • SSH-PUBLIC-KEY with the user's SSH public key string.

   The "status": 1 field activates the user account. Without it, the user is created in a disabled state and cannot log in.

Data Migration

Transfer data from Azure Blob Storage to the SFTPGo storage backend.

1. If using Azure Blob as the SFTPGo backend, point users to the same container. No data migration is required.

2. For local filesystem backend, download data using Azure CLI. Replace the placeholders with your storage account details.

   CONSOLE

   Copy

   $ az storage blob download-batch --account-name STORAGE-ACCOUNT --source CONTAINER-NAME --destination ~/sftpgo/data/USERNAME/

   Explain Code

   Powered by Vultr AgentBeta

3. Set correct ownership on downloaded files.

   CONSOLE

   Copy

   $ sudo chown -R 1000:1000 ~/sftpgo/data/

   Explain Code

   Powered by Vultr AgentBeta

Authentication Migration

Convert Azure authentication methods to SFTPGo equivalents.

For Azure AD integration, configure an external authentication hook that validates against your identity provider.

Client Configuration Updates

Update SFTP client applications with the new endpoint.

1. Document the new connection parameters:

   • Host: sftp.example.com (your SFTPGo server)
   • Port: 2022 (SFTP)
   • Authentication: SSH key or password
   • Protocol: SFTP

2. Distribute updated connection details to users.

3. Update automated scripts and integrations.

4. Test each client before disabling Azure Storage SFTP.

Things to Consider During Migration

Address Azure-specific features when migrating:

• Hierarchical Namespace: Azure Storage SFTP requires HNS. SFTPGo simulates directories without this requirement, which may affect applications that depend on HNS behavior.

• Container-Level Permissions: Azure assigns permissions per container. Map these to SFTPGo's per-directory permissions under the ACLs section.

• Azure AD Authentication: If using Azure AD (preview), configure SFTPGo with an external authentication hook or LDAP plugin to integrate with your identity provider.

• Storage Lifecycle Policies: SFTPGo does not manage Azure Blob lifecycle rules. Configure lifecycle policies directly in Azure Storage if continuing to use Azure Blob as the backend.

• Azure Monitor Integration: Replace Azure Monitor logging with SFTPGo's built-in logging, syslog forwarding, or webhook integrations.

• Managed SSH Host Keys: Export the SSH host key from SFTPGo (/var/lib/sftpgo/id_*) and distribute the fingerprint to clients to avoid host key warnings.

Conclusion

You have deployed SFTPGo as a self-hosted alternative to Azure Storage SFTP using Docker Compose. The setup includes SFTP protocol support, Azure Blob Storage backend integration, user authentication with SSH keys and passwords, and access controls matching Azure Storage SFTP capabilities. This configuration eliminates the $0.30/hour (~$220/month) charge while providing equivalent file transfer functionality. For additional features including plugins, clustering, and enterprise options, refer to the official SFTPGo documentation.