faucet-common-sftp 1.0.0

Shared SFTP connection config for the faucet-stream source and sink
Documentation

faucet-common-sftp

Shared SFTP connection configuration and connect helper for the faucet-source-sftp and faucet-sink-sftp connectors in the faucet-stream ecosystem.

This crate is a small building block, not a connector itself. It provides:

  • SftpConnectionConfig — host, port (default 22), username, auth, host-key policy. Its fields are #[serde(flatten)]ed into the source/sink configs, so end users see one flat config block.
  • SftpAuth — password or private_key (with optional passphrase), serialized with the faucet { type, config } shape. Its Debug impl never prints the password or passphrase.
  • HostKeyPolicy — how the server host key is verified (see below).
  • async fn connect(&SftpConnectionConfig) -> Result<SftpSession, FaucetError> — opens the SSH transport, authenticates, verifies the host key, and opens the sftp subsystem.

Host-key verification

Man-in-the-middle protection is on by default. The policy is selected via the known_hosts block:

mode Behaviour
accept_new Default. Trust-on-first-use: record an unknown host key in ~/.ssh/known_hosts, reject a key that has changed.
strict Reject any key not already present in known_hosts (optionally at a custom known_hosts_path).
insecure Disable verification entirely. Vulnerable to MITM — use only on trusted networks / test servers.

Auth config shapes

# Password
type: password
config:
  password: ${env:SFTP_PASSWORD}

# Private key
type: private_key
config:
  path: /home/me/.ssh/id_ed25519
  passphrase: ${env:SFTP_KEY_PASSPHRASE}   # optional

Licensed under MIT OR Apache-2.0.