case xsftp.AcceptNetworkError:
		sftpLogOnceIf(context.Background(), err, "accept-limit-sftp")
	case xsftp.AcceptChannelError:
		sftpLogOnceIf(context.Background(), err, "accept-channel-sftp")
	case xsftp.SSHKeyExchangeError:
		sftpLogOnceIf(context.Background(), err, "key-exchange-sftp")
	default:
		sftpLogOnceIf(context.Background(), err, "unknown-error-sftp")
	}
}

	defer cancel()

	// we need to do this so that the user has a policy before authentication.
	// ldap user accounts without policies are denied access in sftp.
	policy := "mypolicy"
	policyBytes := []byte(`{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Allow",
   "Action": [
    "s3:PutObject",
    "s3:GetObject",
    "s3:ListBucket"

	}
}

func (m *sftpMetrics) log(s *sftp.Request, user string) func(sz int64, err error) {
	startTime := time.Now()
	source := getSource(2)
	return func(sz int64, err error) {
		globalTrace.Publish(sftpTrace(s, startTime, source, user, err, sz))
	}
}

// NewSFTPDriver initializes sftp.Handlers implementation of following interfaces
//
// - sftp.Fileread
// - sftp.Filewrite
// - sftp.Filelist
// - sftp.Filecmd

...
```


Following example shows connecting via sftp client using `minioadmin` credentials, and list a bucket named `runner`:

```
sftp -P 8022 minioadmin@localhost
minioadmin@localhost's password:
Connected to localhost.
sftp> ls runner/
chunkdocs  testdir
```

Following example shows how to download an object locally via `sftp` client:

```
sftp> get runner/chunkdocs/metadata metadata

type Opts struct {
	FTP struct {
		Address          string `yaml:"address"`
		PassivePortRange string `yaml:"passive-port-range"`
	} `yaml:"ftp"`
	SFTP struct {
		Address       string `yaml:"address"`
		SSHPrivateKey string `yaml:"ssh-private-key"`
	} `yaml:"sftp"`
}

// ServerConfigVersion struct is used to extract the version
type ServerConfigVersion struct {
	Version string `yaml:"version"`
}

	}

	if cf.Options.SFTP.Address != "" {
		ctxt.SFTP = append(ctxt.SFTP, fmt.Sprintf("address=%s", cf.Options.SFTP.Address))
	}
	if cf.Options.SFTP.SSHPrivateKey != "" {
		ctxt.SFTP = append(ctxt.SFTP, fmt.Sprintf("ssh-private-key=%s", cf.Options.SFTP.SSHPrivateKey))
	}
}

func mergeServerCtxtFromConfigFile(configFile string, ctxt *serverCtxt) error {

      - "https://server4-pool2:9000/mnt/disk{1...4}/"
  # more args

options:
  ftp: # settings for MinIO to act as an ftp server
    address: ":8021"
    passive-port-range: "30000-40000"
  sftp: # settings for MinIO to act as an sftp server
    address: ":8022"
    ssh-private-key: "/home/user/.ssh/id_rsa"
```

If you are using the config `v1` YAML you should migrate your `pools:` field values to the following format

var errSessionPolicyTooLarge = errors.New("Session policy should not exceed 2048 characters")

// error returned in SFTP when user used public key without certificate
var errSftpPublicKeyWithoutCert = errors.New("public key authentication without certificate is not accepted")

// error returned in SFTP when user used certificate which does not contain principal(s)

		ctxt.MemLimit = mlimit
	} else {
		ctxt.MemLimit = memAvailable
	}

	if memAvailable < ctxt.MemLimit {
		ctxt.MemLimit = memAvailable
	}

	ctxt.FTP = ctx.StringSlice("ftp")
	ctxt.SFTP = ctx.StringSlice("sftp")
	ctxt.Interface = ctx.String("interface")
	ctxt.UserTimeout = ctx.Duration("conn-user-timeout")
	ctxt.SendBufSize = ctx.Int("send-buf-size")
	ctxt.RecvBufSize = ctx.Int("recv-buf-size")

	Addr, ConsoleAddr         string
	ConfigDir, CertsDir       string
	configDirSet, certsDirSet bool
	Interface                 string

	RootUser, RootPwd string

	FTP  []string
	SFTP []string

	MemLimit uint64

	UserTimeout         time.Duration
	IdleTimeout         time.Duration
	ReadHeaderTimeout   time.Duration
	MaxIdleConnsPerHost int

	SendBufSize, RecvBufSize int