What causes "user is not allowed to access via SFTP" in AlistGo/alist?

Grant the 'ftp access' permission to the guest user's role and re-enable the guest account (only if anonymous SFTP is desired)

AlistGo/alist · error

user is not allowed to access via SFTP

Error message

user is not allowed to access via SFTP

What it means

Returned in SftpDriver.NoClientAuth's guest branch: the connecting user is 'guest' with none-auth, but the guest account is either disabled or its merged role permissions lack the FTP access bit (PermFTPAccess — SFTP deliberately reuses the FTP permission rather than having its own). The guest is resolved via op.GetGuest and checked with MergeRolePermissions before anonymous SFTP is allowed.

Source

Thrown at server/sftp.go:84

	ctx = context.WithValue(ctx, "client_ip", sc.RemoteAddr().String())
	ctx = context.WithValue(ctx, "proxy_header", d.proxyHeader)
	return &sftp.DriverAdapter{FtpDriver: ftp.NewAferoAdapter(ctx)}, nil
}

func (d *SftpDriver) Close() {
}

func (d *SftpDriver) NoClientAuth(conn ssh.ConnMetadata) (*ssh.Permissions, error) {
	if conn.User() != "guest" {
		return nil, errors.New("only guest is allowed to login without authorization")
	}
	guest, err := op.GetGuest()
	if err != nil {
		return nil, err
	}
	permGuest := common.MergeRolePermissions(guest, guest.BasePath)
	if guest.Disabled || !common.HasPermission(permGuest, common.PermFTPAccess) {
		return nil, errors.New("user is not allowed to access via SFTP")
	}
	return nil, nil
}

func (d *SftpDriver) PasswordAuth(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) {
	userObj, err := op.GetUserByName(conn.User())
	if err != nil {
		return nil, err
	}
	perm := common.MergeRolePermissions(userObj, userObj.BasePath)
	if userObj.Disabled || !common.HasPermission(perm, common.PermFTPAccess) {
		return nil, errors.New("user is not allowed to access via SFTP")
	}
	passHash := model.StaticHash(string(password))
	if err = userObj.ValidatePwdStaticHash(passHash); err != nil {
		return nil, err
	}
	return nil, nil

View on GitHub (pinned to 843d9dc814)

Solutions

Grant the 'ftp access' permission to the guest user's role and re-enable the guest account (only if anonymous SFTP is desired)
If anonymous access should stay closed, connect with a real username/password instead
Verify with a real admin account that SFTP itself works before touching guest settings

Defensive patterns

Strategy: validation

Validate before calling

// Mirror the server check before offering anonymous SFTP
guest, _ := op.GetGuest()
perm := common.MergeRolePermissions(guest, guest.BasePath)
if guest.Disabled || !common.HasPermission(perm, common.PermFTPAccess) {
    disableAnonymousSftp()
}

Try / catch

if err != nil && strings.Contains(err.Error(), "user is not allowed to access via SFTP") {
    // for guest none-auth: enable guest + ftp access permission, or switch to a real account
}

Prevention

SFTP shares the FTP access permission bit — grant it to the guest role only if anonymous access is intended
Keep the guest account disabled when anonymous access is unwanted; this error is then correct behavior
Check the same permission whenever FTP behavior changes, since one bit governs both

When it happens

Trigger: Anonymous SFTP as guest when the guest user is disabled in the admin UI, or when the guest user's role does not include the 'ftp access' permission.

Common situations: SFTP enabled but guest permissions never configured; admin disabled the guest account to close anonymous access (this error is then the intended enforcement); fresh installs where the default role lacks ftp access.

Related errors

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/62ff141152023f6e. Report an issue: GitHub.