Access, under control.

One engine, several identity paths#

Local users live in the embedded store with Argon2id hashing by default; bcrypt is also supported. LDAP integration can authenticate directory users. SFTP and SCP accept passwords and SSH public keys.

WebUI OIDC single sign-on uses discovery and the authorization-code flow with PKCE. OIDC covers WebUI/API sessions, not FTP or SSH authentication. Enforce MFA at the identity provider for SSO; Kervan’s local TOTP flow is separate.

Use plain OpenSSH public keys. Account key management rejects authorized_keys options because their restrictions would not be enforced. SSH certificates and keyboard-interactive authentication are not supported.

Give each user a boundary#

Set home directories, permissions, group templates, expiry times, allowed addresses, allowed protocols and session limits. Protocol restrictions can require FTPS for an individual user instead of allowing plain FTP.

Global and per-user IP restrictions combine to narrow access. Deny rules take precedence. Open transfer sessions are periodically checked for account deletion, disablement, expiry and address restrictions; WebUI/API requests are checked on each call.

./kervan user access --username alice \
  --expires 2026-12-31 \
  --allowed-ips 10.0.0.0/8 \
  --protocols ftps,sftp \
  --max-sessions 2

Protect every listener#

IP/CIDR allow and deny rules apply across FTP, SSH and the WebUI/API. Per-protocol connection caps and a cross-protocol per-IP connection cap can bound exposure. Brute-force controls include account lockouts and shared IP bans.

Behind a reverse proxy, the API sees the proxy’s address. Filter external WebUI clients at the proxy as needed. The /health endpoint remains available for local health checks.

security:
  allowed_ips: [10.0.0.0/8]
  denied_ips: []
  max_connections_per_ip: 20
  brute_force:
    enabled: true
    max_attempts: 5
    lockout_duration: 15m
    ip_ban_threshold: 20
    ip_ban_duration: 1h

Encrypt connections explicitly#

SFTP and SCP use SSH transport encryption. FTPS requires its own certificate and key configuration. The WebUI can serve TLS or sit behind a TLS reverse proxy. Plain FTP and an HTTP management listener do not provide encryption.

Kervan’s WebUI includes CSP, frame protection and other HTTP hardening headers, with HSTS on TLS connections. Cross-origin access is disabled by default; configure only the specific origins that need it.

Scoped automation credentials#

Create API keys with the smallest permission set a task requires. The CLI can list supported scopes and presets. Keys can be revoked from the CLI or WebUI, and raw key material is shown once on creation.

./kervan apikey scopes
./kervan apikey presets
./kervan apikey create --username alice \
  --name 'Report uploader' \
  --permissions files:read,files:write