Nick Craig-Wood
e8e883c35e
With --auth-proxy set and --auth-key unset, serve s3 registered every client supplied access key ID with an empty secret and verified the SigV4 signature against that, so anyone could sign a request for an arbitrary access key ID with an empty secret and be let in. The proxy program was only ever given the access key ID (as both user and pass) so it had nothing with which to authenticate the client either. An S3 client never sends its secret, only a signature made with it, so the server has to know the secret to check the request. The auth proxy protocol as been changed to handle this. For serve s3 the proxy program is given just the access key ID as the user (no pass or public_key) and must return the matching secret as _secret_access_key in its output. rclone verifies the request's signature against that secret, refusing the request if the proxy rejects the access key ID, doesn't return a secret or returns an empty one, or the signature doesn't match. The secret is only used for this server's own verification and is never registered with gofakes3, so other serve s3 instances in the same process don't honour it. The proxy's answers are cached. If a signature fails against a cached secret the proxy is consulted again so a rotated secret takes effect immediately - but only for a signature mismatch, and at most once every 10 seconds per access key ID and client IP, so a stream of bad signatures can't make the proxy program run for every request. A rotation never shuts down the cached backend under requests still using it. A cached answer is checked with the proxy again once it is 5 minutes old even if in constant use, so revoking an access key ID takes effect within 5 minutes. This means --auth-key is no longer needed with --auth-proxy: it is ignored and a warning is given at startup if both are set. The proxy is the source of truth for both the credentials and the backend they map to. Presigned URLs (credential in the query string) are now recognised by the proxy middleware too. The auth proxy docs are added to serve s3. Note that the serve s3 auth proxy protocol has changed. The proxy program is now given the access key ID as "user" (it was previously given an MD5 hash of it, with the access key ID as "pass") and must return the matching secret as "_secret_access_key". This needs gofakes3 v0.0.9 for signature.V4SignVerifyWithSecret.
Website | Documentation | Download | Contributing | Changelog | Installation | Forum
Rclone
Rclone ("rsync for cloud storage") is a command-line program to sync files and directories to and from different cloud storage providers.
Storage providers
- 1Fichier 📄
- Akamai Netstorage 📄
- Alibaba Cloud (Aliyun) Object Storage System (OSS) 📄
- Amazon S3 📄
- ArvanCloud Object Storage (AOS) 📄
- Bizfly Cloud Simple Storage 📄
- Backblaze B2 📄
- Box 📄
- Ceph 📄
- China Mobile Ecloud Elastic Object Storage (EOS) 📄
- Citrix ShareFile 📄
- Cloudflare R2 📄
- Cloudinary 📄
- Cubbit DS3 📄
- DigitalOcean Spaces 📄
- Digi Storage 📄
- Dreamhost 📄
- Drime 📄
- Dropbox 📄
- Enterprise File Fabric 📄
- Exaba 📄
- Fastly Object Storage 📄
- Fastmail Files 📄
- FileLu 📄
- Filen 📄
- Files.com 📄
- FlashBlade 📄
- FTP 📄
- GoFile 📄
- Google Cloud Storage 📄
- Google Drive 📄
- Google Photos 📄
- HDFS (Hadoop Distributed Filesystem) 📄
- Hetzner Object Storage 📄
- Hetzner Storage Box 📄
- HiDrive 📄
- Hitachi Content Platform (HCP) 📄
- HTTP 📄
- Huawei Cloud Object Storage Service(OBS) 📄
- Huawei Drive 📄
- iCloud Drive 📄
- ImageKit 📄
- Internet Archive 📄
- Internxt 📄
- Jottacloud 📄
- IBM COS S3 📄
- Impossible Cloud 📄
- Intercolo Object Storage 📄
- IONOS Cloud 📄
- Koofr 📄
- Leviia Object Storage 📄
- Liara Object Storage 📄
- Linkbox 📄
- Linode Object Storage 📄
- Magalu Object Storage 📄
- Mail.ru Cloud 📄
- Memset Memstore 📄
- MEGA 📄
- MEGA S4 Object Storage 📄
- Memory 📄
- Microsoft Azure Blob Storage 📄
- Microsoft Azure Files Storage 📄
- Microsoft OneDrive 📄
- Minio 📄
- Nextcloud 📄
- Blomp Cloud Storage 📄
- OpenDrive 📄
- OpenStack Swift 📄
- Oracle Cloud Storage 📄
- Oracle Object Storage 📄
- Outscale 📄
- OVHcloud Object Storage (Swift) 📄
- OVHcloud Object Storage (S3-compatible) 📄
- ownCloud 📄
- pCloud 📄
- Petabox 📄
- PikPak 📄
- Pixeldrain 📄
- premiumize.me 📄
- put.io 📄
- Proton Drive 📄
- QingStor 📄
- Qiniu Cloud Object Storage (Kodo) 📄
- Rabata Cloud Storage 📄
- Quatrix 📄
- Rackspace Cloud Files 📄
- RackCorp Object Storage 📄
- rsync.net 📄
- Scaleway 📄
- Scality (RING / ARTESCA) 📄
- Seafile 📄
- Seagate Lyve Cloud 📄
- SeaweedFS 📄
- Selectel Object Storage 📄
- Servercore Object Storage 📄
- SFTP 📄
- Shade 📄
- SMB / CIFS 📄
- Spectra Logic 📄
- Storj 📄
- SugarSync 📄
- Synology C2 Object Storage 📄
- Tencent Cloud Object Storage (COS) 📄
- Uloz.to 📄
- US3 Object Storage 📄
- Wasabi 📄
- WebDAV 📄
- Yandex Disk 📄
- Zadara Object Storage 📄
- Zero Services (ZERO-Z3) 📄
- Zoho WorkDrive 📄
- Zata.ai 📄
- The local filesystem 📄
Please see the full list of all storage providers and their features
Virtual storage providers
These backends adapt or modify other storage providers
- Alias: rename existing remotes 📄
- Archive: read archive files 📄
- Cache: cache remotes (DEPRECATED) 📄
- Chunker: split large files 📄
- Combine: combine multiple remotes into a directory tree 📄
- Compress: compress files 📄
- Crypt: encrypt files 📄
- Hasher: hash files 📄
- Union: join multiple remotes to work together 📄
Features
- MD5/SHA-1 hashes checked at all times for file integrity
- Timestamps preserved on files
- Partial syncs supported on a whole file basis
- Copy mode to just copy new/changed files
- Sync (one way) mode to make a directory identical
- Bisync (two way) to keep two directories in sync bidirectionally
- Check mode to check for file hash equality
- Can sync to and from network, e.g. two different cloud accounts
- Optional large file chunking (Chunker)
- Optional transparent compression (Compress)
- Optional encryption (Crypt)
- Optional FUSE mount (rclone mount)
- Multi-threaded downloads to local disk
- Can serve local or remote files over HTTP/WebDAV/FTP/SFTP/DLNA
Installation & documentation
Please see the rclone website for:
Downloads
License
This is free software under the terms of the MIT license (check the COPYING file included in this package).