Four ways to connect.

FTP: active and passive#

Kervan implements FTP with active PORT/EPRT and passive PASV/EPSV data channels. Configure the passive port range and advertised passive IP when running behind NAT or Docker. Active callbacks are restricted to the control connection’s address and unprivileged ports.

The protocol supports uploads, downloads, appends, resumable transfers, directory operations, renames, machine-readable listings, timestamps and transfer cancellation. TYPE A is accepted for compatibility, but data is always transferred byte for byte.

curl --user alice ftp://localhost:2121/
curl --user alice -T report.csv ftp://localhost:2121/

FTPS: explicit or implicit TLS#

FTPS is disabled by default. Set ftps.enabled and provide a certificate and private key. Select explicit, implicit or both modes. Explicit TLS uses AUTH TLS on the FTP port; implicit TLS defaults to port 990.

TLS 1.2 and 1.3 limits are configurable. Optional client-certificate verification uses the FTPS client CA setting. Configuring TLS on the WebUI alone does not enable FTPS.

ftps:
  enabled: true
  mode: explicit
  min_tls_version: "1.2"
  max_tls_version: "1.3"
  cert_file: /etc/kervan/tls/cert.pem
  key_file: /etc/kervan/tls/key.pem

SFTP: SSH file transfers#

SFTP v3 runs on the SSH listener at port 2222 by default. Passwords and SSH public keys are supported. An Ed25519 host key is generated on first start; the keygen command can also pre-create Ed25519 or RSA keys.

Supported OpenSSH extensions include posix-rename, statvfs/fstatvfs, fsync and limits. The server provides file transfers rather than an interactive shell or port forwarding. Symlinks, SSH certificate authentication and keyboard-interactive authentication are not supported.

sftp -P 2222 alice@localhost
 
# Pre-create a host key before starting the server
./kervan keygen --type ed25519 --output ./data/host_keys

SCP: scripts welcome#

Legacy SCP implements source and sink modes, recursive copies and time preservation. It uses the same SSH listener as SFTP and the same VFS and audit pipeline. Modern OpenSSH scp uses SFTP by default; -O explicitly requests legacy SCP.

# Default SFTP transport on modern OpenSSH
scp -P 2222 report.csv alice@localhost:/
 
# Legacy SCP, recursively
scp -O -P 2222 -r ./reports alice@localhost:/

Test your client workflow#

The repository includes live interoperability tests with OpenSSH sftp/scp and curl. Wider checks with FileZilla, WinSCP, lftp and Cyberduck remain on the roadmap. Validate the exact client, protocol features and network setup you plan to deploy.

FTP virtual hosts use RFC 7151 HOST or FTPS SNI and can restrict logins by group. They do not apply to SFTP or SCP, because SSH does not carry an equivalent host name.