Cyberduck

Prerequisites

Have the following in place before you launch the Cyberduck AMI.

AWS account: You need an active AWS account with permissions to launch EC2 instances, manage security groups and access the AWS Marketplace.

EC2 key pair: Create a key pair, or identify an existing one, in the region where you plan to launch the instance. You need it to decrypt the Windows Administrator password after launch.

Security group: Prepare a security group that allows inbound RDP: protocol TCP, port 3389, for Remote Desktop access. Restrict the source IP range to your known IP addresses or corporate CIDR blocks rather than allowing 0.0.0.0/0.

Remote Desktop client: Install a Remote Desktop Protocol client on your local machine. Options include Microsoft Remote Desktop (Windows and macOS), Remmina (Linux) or any other RDP-compatible client.

Minimum instance requirements: 1 vCPU, 1 GB of RAM and 30 GB of disk space.

A t3.small or larger instance type is recommended for comfortable use. If you plan to transfer large volumes of data, choose an instance type with enhanced networking.

Step-by-Step Setup

Follow these steps to launch your Cyberduck instance and connect to it.

Step 1: Launch the instance

• Log in to your AWS account and open the AWS Marketplace.
• Search for the SecureAnyCloud Cyberduck AMI.
• Select an instance type (t3.small or larger is recommended).
• Choose your region and VPC configuration.
• Select the EC2 key pair you created in the prerequisites.
• Assign the security group with RDP access on port 3389.
• Configure storage (30 GB minimum on the root volume).
• Launch the instance.

Step 2: Wait for status checks

Open the EC2 console and wait until the instance shows 2/2 status checks passing. This means the instance has fully booted and Windows has finished its initial setup. It typically takes between 3 and 10 minutes.

Step 3: Retrieve the Administrator password

• Open the EC2 console in the AWS region where you launched the instance.
• Select Instances from the left navigation panel.
• Select your new instance.
• Click Actions at the top of the page.
• Choose Security, then Get Windows password.
• Click Browse and upload the private key file (.pem) from the key pair you selected at launch.
• Click Decrypt password.
• Copy the decrypted password and store it securely. This is your Administrator password.

Step 4: Connect with Remote Desktop

• Open your Remote Desktop client.
• Create a new connection using the public IP address of your EC2 instance. Use the private IP if you connect through a VPN or from within the same VPC.
• Enter the credentials when prompted. The username is Administrator. The Password is the decrypted value from Step 3.
• If a certificate warning appears, click Continue. The warning is expected for new connections.

The Windows Server desktop opens.

Step 5: Launch Cyberduck

On the desktop, double-click the Cyberduck shortcut to launch the application. Cyberduck is preinstalled and ready for immediate use.

Server Components

The AMI is built on Windows Server and includes Cyberduck, preinstalled and configured. The Cyberduck version is Latest.

Cyberduck supports these transfer protocols out of the box: FTP, SFTP, WebDAV, Amazon S3, Google Cloud Storage, Microsoft Azure and OpenStack Swift.

Filesystem Layout

The instance uses a single volume. Drive C:\ holds the operating system and the application, and needs a minimum of 30 GB.

Key directory locations on the instance:

C:\Program Files\Cyberduck\: Cyberduck installation directory

C:\Users\Administrator\Desktop\: Desktop with the Cyberduck shortcut

C:\Users\Administrator\AppData\Roaming\Cyberduck\: User configuration and bookmarks

C:\Users\Administrator\Downloads\: Default download location for transfers

If you plan to transfer or stage large volumes of data, attach an additional EBS volume in the AWS console and use it as the download destination. This keeps the system drive from filling up.

Managing the Application

Open Cyberduck

Double-click the Cyberduck icon on the Windows desktop. The main browser window opens, where you can create new connections or select saved bookmarks.

Connect to Amazon S3

• Click Open Connection in the Cyberduck toolbar.
• Select Amazon S3 from the protocol dropdown.
• Enter your AWS Access Key ID and Secret Access Key.
• Click Connect to browse your S3 buckets.

For better security, attach an IAM role to the EC2 instance instead of using static access keys. Cyberduck can use instance profile credentials when configured appropriately.

Connect with SFTP

• Click Open Connection in the Cyberduck toolbar.
• Select SFTP (SSH File Transfer Protocol) from the protocol dropdown.
• Enter the server hostname, port (default 22), username, and password or SSH key.
• Click Connect to browse the remote filesystem.

Connect with FTP

• Click Open Connection in the Cyberduck toolbar.
• Select FTP (File Transfer Protocol) or FTP SSL (Explicit AUTH TLS) from the protocol dropdown.
• Enter the server hostname, port (default 21), username and password.
• Click Connect to browse the remote filesystem.

Create bookmarks

To save a frequently used connection, choose Bookmark, then New Bookmark in the menu bar. Fill in the connection details. The bookmark appears in the main window for quick access in future sessions.

Transfer files

To upload files, drag them from the local Windows filesystem into the Cyberduck browser window. To download files, select them in the remote browser and choose File, then Download. You can also drag them to your local desktop or a folder.

Synchronize directories

Cyberduck can synchronize local and remote locations. Right-click a folder in the browser and select Synchronize to compare and synchronize files in both directions.

Scripts and Logs

Cyberduck log files

Cyberduck writes application and transfer logs to C:\Users\Administrator\AppData\Roaming\Cyberduck\log\. Use them to diagnose connection and transfer issues.

For verbose logging, open the Cyberduck preferences, go to the advanced settings and enable debug logging. Cyberduck then records detailed output about connection attempts and transfer operations.

Windows event logs

For system-level diagnostics, open the Windows Event Viewer. Press the Windows key, search for Event Viewer and open it to review application and system logs.

Troubleshooting

Cannot connect via RDP

• Check that the instance has passed 2/2 status checks in the EC2 console.
• Confirm that your security group allows inbound TCP traffic on port 3389 from your IP address.
• Check that you are using the correct public IP address. If the instance was stopped and started, the public IP may have changed unless you use an Elastic IP.
• Check that your local firewall or corporate network is not blocking outbound RDP connections.

Password decryption fails

• Upload the .pem file that matches the key pair you selected at launch.
• The password can take up to 15 minutes to become available after the first launch. If the option is greyed out, wait and try again.

Cyberduck cannot connect to S3

• Check that your AWS credentials (Access Key ID and Secret Access Key) are correct.
• If you use an IAM role attached to the instance, check that the role has the necessary S3 permissions.
• Check that the security group allows outbound HTTPS traffic on port 443, which S3 API calls require.
• If you connect to S3 in a specific region, check that the correct region endpoint is set in the connection settings.

Cyberduck cannot connect to an SFTP or FTP server

• Check that the target server hostname and port are correct.
• Check that the security group on this instance allows outbound traffic on the required port (22 for SFTP, 21 for FTP).
• Confirm that the remote server's firewall allows inbound connections from this instance's IP address.
• For SFTP with key-based authentication, check that the private key file is accessible and in the correct format.

File transfers are slow

• Check the instance type. An instance with enhanced networking gives higher throughput.
• For S3 transfers, use an instance in the same region as the target bucket. This significantly improves transfer speeds.
• Many small files transfer more slowly than a few large ones. Archive small files into a single archive before you transfer them.

Insufficient disk space

• Monitor C: drive usage in Windows Explorer or with the dir command in the command prompt.
• Attach an additional EBS volume and configure Cyberduck to use it as the default download directory.
• Clean up completed transfers from the Downloads folder regularly.

RDP session disconnects frequently

• Check the stability of your network connection.
• Reduce the bandwidth the RDP client needs by lowering the display quality or disabling visual effects.
• Check that the instance is not running out of memory, which can make Windows unresponsive.

Security Recommendations

Change the Administrator password

After your first login, change the Administrator password to a strong, unique one. Open the Windows command prompt or PowerShell and run:

net user Administrator YourNewStrongPassword

Once you change the password, the original decrypted password from the AWS console is no longer valid.

Restrict RDP access

Limit the security group rule for port 3389 to your own IP addresses or a trusted CIDR range. Avoid 0.0.0.0/0, which exposes the instance to RDP brute-force attacks from the entire internet.

Use IAM roles instead of access keys

When you connect Cyberduck to Amazon S3, attach an IAM role with the necessary S3 permissions to the EC2 instance instead of storing static access keys on the server. This removes the risk of credential leakage and gives you automatic credential rotation.

Secure stored credentials

Cyberduck stores bookmark passwords locally on the instance. Make sure only authorized users have RDP access to it.

Enable Windows Firewall rules

Configure Windows Firewall to allow only the inbound and outbound traffic your file transfer workflows need.

Keep software updated

Update Cyberduck and Windows Server regularly to get the latest security patches and bug fixes. Cyberduck includes a built-in update checker in the application menu.

Use encrypted transfer protocols

Where possible, use SFTP or FTP over TLS instead of plain FTP, so credentials and file data are encrypted in transit.

Use an Elastic IP

Assign an Elastic IP to keep a consistent IP address across stop and start cycles. It also lets remote servers that allow-list this instance keep consistent firewall rules.

Enable CloudWatch monitoring

Configure Amazon CloudWatch to monitor instance metrics such as CPU utilization, memory usage and disk space. Set up alarms that notify you when resources run low.

Support

If you have an issue this guide does not cover, the SecureAnyCloud support team can help with anything related to the AMI. That includes connectivity problems, software configuration and general guidance on the preconfigured environment.

• Email: sales@secureanycloud.com
• Phone: (+44) 02045382725
• Website: secureanycloud.com
• Address: 3rd Floor, 86 90 Paul Street, London, EC2A 4NE

When you contact support, include your EC2 instance ID, the AWS region and a description of the issue, plus any relevant error messages or screenshots.

Deploy on AWS

Launch Cyberduck with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com