Server static files from FTP server using NGINX

Question

I have a local network, on which there are some old insecure services. I use nginx reverse proxy with client certificates authentication as safe entrypoint to this local network from the Internet. Till now I used it only to proxy HTTP servers using

    location / {
        proxy_pass http://192.168.123.45:80/;
    }

and everything works fine.

But now I would like to serve static files, that are accessible through FTP on a local server, I tried simply:

    location /foo {
        proxy_pass ftp://user:[email protected]:5000/;
    }

but that doesn't work, and I could not find anything that would simply proxy HTTP request to FTP request.

Is there any way to do this?

Jacobus

Answer 1

Nginx doesn't support proxying to FTP servers. At best, you can proxy the socket... and this is a real hassle with regular old FTP due to it opening new connections on random ports every time a file is requested.

What you can probably do instead is create a FUSE mount to that FTP server on some local path, and serve that path with Nginx like normal. To that end, CurlFtpFS is one tool for this. Tutorial: https://linuxconfig.org/mount-remote-ftp-directory-host-locally-into-linux-filesystem

(Note: For security and reliability, it's strongly recommended you migrate away from FTP when possible. Consider SSH/SFTP instead.)

Hyunhz

Well, just keep in mind.. SSH/SFTP will perform worse according to the security level added (encrypted connection). – Vanhoose

@HasanAlsawadi Anyone who actually cared about performance wouldn't be doing this sort of proxying in the first place. Also, I challenge your assertion. Doing this over SSH, only one TCP connection is necessary, whereas with FTP a separate connection is created for every transfer. The overhead from crypto is hardly anything, and is often offloaded to hardware. – Hyunhz

Thanks mate, make sense! A benchmark on this would be yummy, will add it to my to-dos ;-) – Vanhoose

Answer 2

You can use nfs mount first you need install on ftp server: example in Debian11

sudo apt-get install nfs-kernel-server

Than on /etc/exports you can sett allow share your dir to ip server

/home/sharedir ip.ip.ip.ip(rw,sync,no_subtree_check,all_squash,anonuid=0,anongid=0)

On Nginx server install

sudo apt-get install nfs-common

and mount dir from first server

mount /mnt/myremotesharedir ip.ip.ip.ip:/home/sharedir

Now you can use in nginx path to /home/sharedir as root or alias

location /foo {
    root /home/sharedir/foo;
}

Low