sftp://¶

SSH-based SFTP endpoint. Distinct wire protocol from FTP — backed by github.com/pkg/sftp on top of golang.org/x/crypto/ssh. Inherits the file:// and ftp:// URI surface (auth, filter, sort, read-lock, scheduler, producer) and adds SSH-specific knobs: private-key auth, known_hosts host-key verification, strict-host-key-checking, custom ciphers / KEX / compression, and server-alive keepalive.

For plain FTP, see ftp://; for TLS-wrapped FTP, see ftps://.

URI shape¶

sftp://host:22/path?username=...&privateKeyFile=~/.ssh/id_rsa&strictHostKeyChecking=yes&knownHostsFile=~/.ssh/known_hosts

host:port defaults to port 22. /path is the starting directory on the remote.

Parameters¶

sftp:// inherits the common-remote and file:// surface — see ftp:// for those. The SSH-specific additions are:

SSH auth¶

Host-key verification¶

Crypto / transport¶

Inherited¶

The full FTP-common and file://-inherited surface applies — auth timeouts, reconnect, binary, passiveMode (no-op on SFTP), stepwise, autoCreate, filter/sort/read-lock/idempotent/scheduler/producer. readLock=fileLock is rejected; remote read-lock defaults are 5 s / 20 s.

Body shape¶

Identical to ftp://:

• Consumer: file bytes in In body (or *exchange.StreamBody with streamDownload=true); CamelFile* headers populated.
• Producer: In body bytes are written to a remote file named by fileName / CamelFileName.

Examples¶

Key-based auth with strict host-key checking:

- from: sftp://partner.example.com/outbox?username=svc&privateKeyFile=/etc/ssl/sftp.key&knownHostsFile=/etc/ssl/known_hosts&strictHostKeyChecking=yes&binary=true&move=.done/${file:name}

Password auth (least preferred, but supported):

- to: sftp://archive.example.com/in?username=user&password=secret&autoCreate=true&chmod=640

Encrypted private key with passphrase:

- from: sftp://server.example.com/data?username=svc&privateKeyFile=~/.ssh/id_rsa_enc&privateKeyPassphrase=<env:SFTP_KEY_PASS>

Keep the SSH session alive on long polls:

- from: sftp://server.example.com/in?username=u&privateKeyFile=~/.ssh/id_rsa&serverAliveInterval=30s&serverAliveCountMax=3

Restrict ciphers/KEX to a hardened set:

- from: sftp://gov.example.com/secure?ciphers=aes256-gcm@openssh.com,aes256-ctr&keyExchangeProtocols=curve25519-sha256,curve25519-sha256@libssh.org&strictHostKeyChecking=yes

Behavior notes¶

• strictHostKeyChecking=no is the default. It WARNs on first connect; turn it on (yes) plus knownHostsFile=... for production.
• Auth precedence. When multiple credentials are supplied, the default order is publickey,password. Override with preferredAuthentications.
• Atomic-rename + chmod on the same path. SFTP supports chmod fully (unlike FTP's best-effort SITE CHMOD).
• Pipelining. bulkRequests controls SFTP request pipelining — raises throughput on large files at the cost of memory.
• passiveMode is no-op on SFTP. It's accepted because the parameter is inherited from FTP, but SFTP has no data-channel concept.

Source¶

• pkg/component/ftp/ftp.go — NewSFTP() registers the sftp scheme on the same Component type.
• pkg/component/ftp/describe.go — SFTP parameters in schemeImplementedDescriptors("sftp").
• pkg/component/ftp/op_sftp.go — SFTP-specific wire I/O.
• pkg/component/ftp/remote.go — SSH config / dial.

See also¶

• Plain FTP: ftp://
• FTPS (TLS-wrapped FTP): ftps://
• Local filesystem: file://