Configure the FTP server¶

When you finish, the cluster accepts only encrypted FTPS sessions, keeps each user inside their home directory, and maps anonymous logins to a local user you control.

Before you start¶

A Qumulo cluster whose REST API on port 8000 you can reach from this machine
An admin account on the cluster for the connection profile
Terraform 1.11 or later
FTP clients that support FTPS (FTP over TLS)

1. Copy the configuration¶

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = "https://cluster.example.com:8000" # <-- Replace with your cluster's REST API endpoint
      username             = "admin"
      password             = "YourClusterPassword123!" # <-- Replace with your admin password
      insecure_skip_verify = true
    },
  ]
}

resource "qumulo_local_group" "ftp" {
  connection_profile = "cluster1"

  name = "ftp"
}

resource "qumulo_local_user" "ftp_anonymous" {
  connection_profile = "cluster1"

  name          = "ftp_anonymous"
  primary_group = qumulo_local_group.ftp.id
}

resource "qumulo_ftp_settings" "main" {
  connection_profile = "cluster1"

  enabled                       = true
  allow_unencrypted_connections = false
  chroot_users                  = true
  check_remote_host             = true
  greeting                      = "Welcome to Qumulo FTP"

  anonymous_user {
    id_type  = "LOCAL_USER"
    id_value = qumulo_local_user.ftp_anonymous.name
  }
}

Replace the two values marked <-- Replace, and leave the rest as written. The configuration also creates the ftp_anonymous local user that anonymous logins act as.

Delete insecure_skip_verify if the cluster's certificate is signed by a CA your machine trusts.

Warning

The provider currently refuses a configuration without the anonymous_user block, so anonymous logins stay on and act as the user it names. Give ftp_anonymous read access only to files you are willing to publish.

2. Fit the server to your clients¶

For legacy clients that cannot use FTPS, set allow_unencrypted_connections = true. Credentials and data then cross the network in clear text.
To let users browse outside their home directories, set chroot_users = false.
To allow server-to-server (FXP) transfers, set check_remote_host = false.
To expand wildcards in LIST and NLST commands, set expand_wildcards = true.
To turn FTP off, set enabled = false.

The plan in step 3 shows each value you changed.

3. Apply¶

terraform init -upgrade
terraform plan
terraform apply

The plan ends with Plan: 3 to add, 0 to change, 0 to destroy. The apply ends with Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

4. Check the cluster¶

Run terraform plan again. It reports No changes. Your infrastructure matches the configuration., which means the cluster's FTP server now runs with the settings you wrote.

Next¶

Give FTP users their own accounts and home directories with Create local users and groups. The qumulo_ftp_settings reference lists every attribute and its default.