How to access buckets via FTP, FTPS, or SFTP

Stand up an Ubuntu gateway VM that mounts a Quake AI bucket with s3fs, then serve that mount over SFTP, FTPS, or FTP for clients that cannot speak S3.

Object storage is not a POSIX filesystem. Use this gateway to upload and download whole files. Avoid in-place edits, locking, and random writes on the mount.

For native S3 from a workstation, see How to mount S3 storage on Windows, macOS, and Linux. For S3 and Swift protocol background, see Object Storage.

Create the instance, bucket, and keys#

1. Create an Ubuntu 24.04 VM. Smaller flavors cap outbound throughput; s1a.micro still reaches about 500 Mbps. Pick a larger flavor if you need more.
2. Attach a security group that opens the ports listed in the prerequisites.
3. Create a bucket.

1. Create S3 credentials.

Install s3fs and mount the bucket#

SSH to the instance as ubuntu, then install s3fs:

sudo apt -y update
sudo apt -y upgrade
sudo apt install -y s3fs

Write the credential file. Replace ACCESS_KEY and SECRET_KEY with the pair from the previous step:

echo "ACCESS_KEY:SECRET_KEY" | sudo tee /etc/passwd-s3fs
sudo chmod 600 /etc/passwd-s3fs

Create the mount point:

sudo mkdir -p /opt/s3storage

Add a line to /etc/fstab. Replace BUCKET_NAME with your bucket and REGION with us-east-1, us-east-2, or us-west-1:

s3fs#BUCKET_NAME /opt/s3storage fuse _netdev,allow_other,passwd_file=/etc/passwd-s3fs,url=https://object.REGION.rumble.cloud/ 0 0

Reload systemd so it picks up the fstab change, then mount:

sudo systemctl daemon-reload
sudo mount /opt/s3storage/

Test SFTP access#

The default Quake AI Ubuntu image serves SFTP on port 22. No extra packages are required.

1. Confirm the bucket is empty.

1. On your workstation, create a test file and open an SFTP session. Replace GATEWAY_IP with the instance address:

echo "This is a test file" > test.txt
sftp ubuntu@GATEWAY_IP

1. In the SFTP session, upload the file to the mount:

sftp> cd /opt/s3storage
sftp> put test.txt
Uploading test.txt to /opt/s3storage/test.txt
sftp> bye

1. Confirm the object appears in the bucket.

Optional: FTP with vsftpd#

Install vsftpd on the gateway:

sudo apt install vsftpd

Edit /etc/vsftpd.conf and uncomment write_enable=YES so clients can upload files.

Restart the daemon:

sudo systemctl restart vsftpd

Create a dedicated FTP user with a home directory and set a password:

sudo useradd -m -s /bin/bash s3gwftp
sudo passwd s3gwftp

From a client that has the ftp command, upload a file. Replace GATEWAY_IP with the instance address:

echo "Unencrypted FTP" > test.txt
ftp s3gwftp@GATEWAY_IP

Connected to GATEWAY_IP...
220 (vsFTPd 3.0.5)
331 Please specify the password.
Password:
230 Login successful.
ftp> cd /opt/s3storage
250 Directory successfully changed.
ftp> put test.txt
226 Transfer complete.
ftp> exit

Confirm the object appears in the bucket.

Optional: FTPS with vsftpd#

Do the FTP steps first. Then enable TLS.

This example uses Ubuntu's default self-signed certificate. For a public hostname, issue a certificate from a public CA such as Let's Encrypt.

Edit /etc/vsftpd.conf:

• Change ssl_enable=NO to ssl_enable=YES
• Add force_local_logins_ssl=YES

Restart vsftpd:

sudo systemctl restart vsftpd

The daemon then accepts FTPS logins only. The stock ftp client does not speak FTPS. Install lftp on the client, then:

sudo apt install lftp
echo "Encrypted FTPS" > test.txt
lftp s3gwftp@GATEWAY_IP

Password:
lftp s3gwftp@GATEWAY_IP:~> set ssl:verify-certificate no
lftp s3gwftp@GATEWAY_IP:~> cd /opt/s3storage
lftp s3gwftp@GATEWAY_IP:/opt/s3storage> put test.txt
lftp s3gwftp@GATEWAY_IP:/opt/s3storage> exit

set ssl:verify-certificate no is required for the Ubuntu self-signed certificate. Drop that line when the gateway presents a certificate your client trusts.

Next steps#

• How to mount S3 storage on Windows, macOS, and Linux: mount the same bucket from a workstation with rclone
• How to create S3 credentials: rotate keys used in /etc/passwd-s3fs
• Create security group rules: tighten FTP or FTPS ports to your client networks

The same s3fs mount can back NFS or SMB if you install those servers yourself. Limit those shares to whole-file upload and download; in-place edits on object storage often fail or corrupt objects.