Netmarga NETMARGA

Standalone SFTP storage · Version 1.1.1

Your private backup storage server.

Install on a separate clean Ubuntu 26.04 server or VM. This installer does not install Core, a VPN, LibreNMS or Traffic Analyser, and does not register the storage server with Hub.

Run on the new storage server

curl --proto '=https' --tlsv1.2 -fsS https://hub.netmarga.com/install-sftp.sh | sudo bash
Inspect installer

Requires root/sudo, running systemd, outbound HTTPS/package repositories, unused TCP ports 2222 and 9443, and sufficient storage. Running it again updates the managed application and preserves administrator passwords, account credentials, host keys and stored files. It refuses installation on Hub/Core or an unmanaged conflicting directory.

Administrator web panel

https://YOUR-SERVER-IP:9443/

The installer prints a one-time setup link. Open it and set the password for admin. The panel uses HTTPS with an initial self-signed certificate. Replace /var/lib/netmarga-sftp-web/panel.crt and panel.key with a trusted hostname certificate if desired, preserving service-account ownership and mode 0600, then restart netmarga-sftp-panel.

Use Accounts → Create new account or Manage accounts to create users, change passwords/public keys, set hard storage limits and disable or re-enable access. Manage accounts shows used and allotted space and refreshes automatically every 15 seconds. SFTP account holders cannot access the admin panel.

Only SFTP for storage accounts

  • SFTP listener: TCP 2222.
  • Separate locked root directory per account.
  • Writable private folder: /data.
  • Password, SSH key, or either authentication method.
  • No shell, command execution, terminal, port forwarding, agent forwarding or access to other accounts.
  • Storage mount uses noexec, nodev, nosuid; uploaded files are not served by the web panel.

Existing Ubuntu administrator management SSH is preserved. Created SFTP accounts are denied access through that ordinary SSH listener.

Use it with Core backups

  1. Create an SSH-key SFTP account in the new admin panel.
  2. In Core → Backup & recovery choose SFTP, enter the storage server IP/hostname, port 2222, account username and path /data/netmarga.
  3. Copy the storage server’s public host key shown in its admin panel into Core’s SFTP host-key field.
  4. Save Core backup settings and run Test / prepare destination. Copy Core’s generated public key into the SFTP account and save it, then test again.
  5. Run a full backup and verify its restore point before enabling the schedule.

SFTP directories are isolated; do not use the physical server path in Core. The path is relative to that account’s locked filesystem root.

Disk expansion

The installer expands supported dedicated Ubuntu root disks to use the VM’s available space, including a single linear LVM volume on one physical volume. It grows the last partition when needed, the LVM physical/logical volume, and ext4 or XFS. It never formats or shrinks disks. Shared volume groups, encryption, RAID, separate SFTP filesystems and complex layouts are skipped with a message in the installer log. Partition and LVM metadata are backed up under /var/backups/netmarga-sftp/storage before changes. Rerun the installer to use newly added VM disk capacity.

Hard account quotas require ext4, or XFS already configured with user quotas. Unsupported quota configurations stop installation rather than allow unlimited uploads.

Operations

Allow TCP 2222 for backup clients and TCP 9443 for your administrator network in the upstream firewall. An existing active UFW firewall receives allow rules for these ports; other firewall rules are preserved.

Data location: /srv/netmarga-sftp/ACCOUNT/data. Account state: /var/lib/netmarga-sftp. Web authentication state: /var/lib/netmarga-sftp-web. SSH configuration/keys: /etc/netmarga-sftp. Keep these with your storage-server recovery backups.

Service logs: journalctl -u netmarga-sftp -u netmarga-sftp-panel -u netmarga-sftp-worker. Installer log: /var/log/netmarga-sftp-installer.log. Disabling an account disconnects its sessions without deleting data. Hard limits block uploads once reached and can be increased from Manage accounts. Files are not automatically deleted.

Execution restrictions protect against SFTP account access. The operating-system root administrator retains the ability to change mounts and security policy. Directories remain private even if a user uploads executable files; no interpreter or shell is supplied inside the account jail.