Install and Secure MinIO Object Storage on Ubuntu 24.04

MinIO is an open-source, high-performance object storage solution that provides an S3-compatible API for managing and sharing files as objects. It is based on a server and console architecture, allowing multiple access methods such as a web interface, the mc command-line tool, and other S3-compatible clients like S3 Browser, Cyberduck, and s3cmd.

This guide walks you through deploying MinIO on Ubuntu 24.04. You will install and configure MinIO using a Single Node Single Drive (SNSD) setup and connect it to a Block Storage device for storing objects.

Prerequisites

Before beginning, ensure the following:

• An Ubuntu 24.04 server with a non-root user and sudo privileges.
• A domain A record pointing to the server’s IP (e.g., minio.example.com).
• A provisioned and mounted block storage volume at /mnt/minio-data.

Install MinIO

MinIO is not available in the default Ubuntu APT repositories. You need to download the official Debian package from the MinIO release page and install it manually with dpkg.

Download MinIO Debian package

$ wget https://dl.min.io/server/minio/release/linux-amd64/minio_20250422221226.0.0_amd64.deb -O minio.deb

The above command downloads the MinIO Debian package and saves it as minio.deb. To confirm the latest release, check the official releases page.

Install MinIO package

$ sudo dpkg -i minio.deb

Verify installation

$ minio --version

You should see output similar to:

minio version RELEASE.2025-04-22T22-12-26Z (commit-id=0d7408fc9969caf07de6a8c3a84f9fbb10a6739e)
Runtime: go1.24.2 linux/amd64

Configure MinIO

MinIO is controlled using the minio command. It supports options for defining ports, storage volumes, and administrator credentials. These need to be set up in a persistent configuration file for service management.

Create configuration file

$ sudo nano /etc/default/minio

Add the following content:

MINIO_VOLUMES="/mnt/minio-data"
MINIO_OPTS="-C /etc/minio --address :9000 --console-address :9001"
MINIO_ROOT_USER="minio_admin"
MINIO_ROOT_PASSWORD="strong-password"

Replace minio_admin and strong-password with your credentials (minimum 8 characters for password).

Create MinIO user

$ sudo useradd -m -s /usr/sbin/nologin minio-user

Assign ownership to storage directory

$ sudo chown minio-user:minio-user /mnt/minio-data

Enable and start service

$ sudo systemctl enable minio
$ sudo systemctl start minio.service

Check service status

$ sudo systemctl status minio.service

Secure MinIO with SSL

By default, MinIO runs on ports 9000 (API) and 9001 (console). For security, it is recommended to use HTTPS with Let’s Encrypt certificates and bind the console to port 443.

Install Certbot and request certificates

$ sudo ufw allow 80/tcp
$ sudo apt install certbot -y
$ sudo certbot certonly --standalone -d minio.example.com -m hello@example.com --agree-tos

Test auto-renewal:

$ sudo certbot renew --dry-run

Configure SSL directory and permissions

$ sudo mkdir -p /opt/minio-certs
$ sudo cp /etc/letsencrypt/live/minio.example.com/fullchain.pem /opt/minio-certs/public.crt
$ sudo cp /etc/letsencrypt/live/minio.example.com/privkey.pem /opt/minio-certs/private.key
$ sudo chown -R minio-user:minio-user /opt/minio-certs/

Enable MinIO SSL binding

$ which minio
$ sudo setcap cap_net_bind_service=+ep /usr/local/bin/minio

Update configuration file

MINIO_VOLUMES="/mnt/minio-data"
MINIO_OPTS="-C /etc/minio --address :9000 --console-address :443 --certs-dir /opt/minio-certs"
MINIO_ROOT_USER="minio_admin"
MINIO_ROOT_PASSWORD="strong-password"
MINIO_DOMAIN="minio.example.com"

Restart service

$ sudo systemctl restart minio
$ sudo systemctl status minio

Update firewall rules

$ sudo ufw allow 443/tcp
$ sudo ufw allow 9000/tcp
$ sudo ufw reload
$ sudo ufw status

Ensure the firewall is active and rules for ports 80, 443, and 9000 are applied.

Access MinIO

Open your browser and go to your MinIO domain using the URL below.

https://minio.example.com

Confirm the MinIO web console loads, then sign in with the administrator credentials defined in /etc/default/minio.

• USERNAME: minio_admin
• PASSWORD: strong-password

Access the MinIO Web Console Interface

After logging in, choose Buckets from the main navigation to begin creating a new object storage bucket.

Click Create a Bucket, then enter a name in the Bucket Name field (for example, centron-test).

Bucket Name Convention Rules

• Length: Bucket names must be 3–63 characters long.
• Allowed Characters: Lowercase letters, numbers, dots (.), and hyphens (-) only.
• No Adjacent Periods: Do not use two periods in a row (..) or a period next to a hyphen (-. or .-).
• No IP Address Formatting: Do not use an IP-style name (for example, 192.168.5.4).
• No xn-- Prefix: Names must not begin with xn--.
• No -s3alias Suffix: Names must not end with -s3alias (reserved for access point aliases).
• Uniqueness: Bucket names must be unique within a partition.

Create a New MinIO Bucket

Enable additional bucket features as needed:

• Versioning: Maintains multiple versions of the same object under one key.
• Object Locking: Blocks deletions and enables retention/legal hold (can only be enabled at bucket creation time).
• Quota: Caps the total data stored in the bucket.
• Retention: Prevents deletions for a specified period. Versioning must be on to use retention policies.

After choosing options, click Create Bucket to provision the MinIO object storage bucket.

Once created, verify it appears in the Buckets list. Click the bucket name to view and adjust its properties.

Upload Files via the Object Browser

From the main navigation, open Object Browser.

Select the new bucket to open its object view, then click Upload and choose Upload File to add files from your device.

Confirm the upload finishes and the file appears in the bucket. To share it, click the object and choose Share to generate an encrypted download URL.

Set the desired expiration and click the copy icon to share the download link.

Access MinIO Using an S3 Browser

S3 client applications provide a secure way to upload and manage objects. The MinIO API listens on port 9000 and accepts S3 connections for creating and managing files. Use an S3 client such as S3 Browser to connect and upload files.

1. In the MinIO console, go to Access Keys to create new authentication keys.
2. Click Create access key to generate access and secret keys.
3. Choose an expiry and a name, then click Create to apply the keys.

Copy the keys or click Download for Import to save them to a file.

4. Download and install an S3 Browser application on your device.
5. Open the S3 Browser app and select Add new account from the Accounts menu.

In Add New Account, enter the following:

• Display Name: A label for your MinIO account.
• Account Type: S3 Compatible Storage.
• API Endpoint: Your MinIO API URL (for example, minio.example.com:9000).
• Access Key ID: The Access Key you created.
• Secret Access Key: The Secret Key you created.
• Use Secure Transfer: Enable to encrypt data in transit.

Click Save Changes to store the account and connect to your MinIO server.

Ensure your MinIO buckets appear in the S3 Browser. Click any bucket to view its objects.

Access MinIO Using s3cmd

s3cmd is a command-line utility for S3-compatible storage like MinIO. It can list, create, and remove buckets, as well as upload and download objects. Follow these steps to use s3cmd with your MinIO server.

Install the s3cmd CLI Utility

Ubuntu/Debian

Update APT package index.

$ sudo apt update

Install the s3cmd package.

$ sudo apt install -y s3cmd

RHEL/Rocky Linux

Refresh the DNF cache.

$ sudo dnf makecache

Install the s3cmd package.

$ sudo dnf install -y s3cmd

macOS (Homebrew)

Update Homebrew.

% brew update

Install the s3cmd package.

% brew install s3cmd

Configure Access Keys

After installation, configure credentials to connect to your MinIO server.

$ s3cmd --configure

When prompted, provide:

• Access Key: The access key from the MinIO console.
• Secret Key: The secret key from the MinIO console.
• Default Region: Press Enter to accept the default.
• S3 Endpoint: Your MinIO API URL (for example, minio.example.com:9000).
• DNS-style bucket+hostname:port: Enter minio.example.com:9000.
• Encryption password: Optional—set a password to encrypt the saved config.
• Use HTTPS protocol: Answer Yes to secure the connection.
• HTTP Proxy server name: Leave blank if you do not use a proxy.

After entering details, review the configuration output:

New settings:
  Access Key: Your Access Key
  Secret Key: Your Secret Access Key
  Default Region: US
  S3 Endpoint: minio.example.com:9000
  DNS-style bucket+hostname:port template for accessing a bucket: minio.example.com:9000
  Encryption password: 
  Path to GPG program: /usr/bin/gpg
  Use HTTPS protocol: True
  HTTP Proxy server name: 
  HTTP Proxy server port: 0
Test access with supplied credentials? [Y/n]

Press Y to validate connectivity.

Common s3cmd Operations

List all buckets on your MinIO server:

$ s3cmd ls

Example output:

2025-04-27 05:06  s3://centron-test

Create a new bucket:

$ s3cmd mb s3://my-new-bucket

Replace my-new-bucket with your bucket name.

List buckets again to confirm the new bucket exists:

$ s3cmd ls

Example output:

2025-04-27 09:52  s3://my-new-bucket
2025-04-27 05:06  s3://centron-test

Upload a file to your bucket:

$ s3cmd put myfile.txt s3://my-new-bucket/

Example output:

upload: 'myfile.txt' -> 's3://my-new-bucket/myfile.txt'  [1 of 1]
 2611218 of 2611218   100% in    0s    11.14 MB/s  done

List objects in a bucket:

$ s3cmd ls s3://my-new-bucket

Example output:

2025-04-27 10:03      2611218  s3://my-new-bucket/myfile.txt

Remove the test file from the local directory:

$ rm myfile.txt

Download a file from your MinIO bucket:

$ s3cmd get s3://my-new-bucket/myfile.txt

Example output:

download: 's3://my-new-bucket/myfile.txt' -> './myfile.txt'  [1 of 1]
 2611218 of 2611218   100% in    0s   107.92 MB/s  done

Delete an object from your bucket:

$ s3cmd del s3://my-new-bucket/myfile.txt

Example output:

delete: 's3://my-new-bucket/myfile.txt'

Remove a bucket from your MinIO server:

$ s3cmd rb s3://my-new-bucket

Example output:

Bucket 's3://my-new-bucket/' removed

List buckets again to verify deletion:

$ s3cmd ls

Example output:

2025-04-27 05:06  s3://centron-test

Conclusion

You have deployed MinIO on Ubuntu 24.04 using a Single Node Single Drive (SNSD) setup backed by a mounted block storage device. With MinIO configured as a system service and protected by Let’s Encrypt SSL certificates, your object storage environment is ready for production. You can manage and share data via the secure web console, command-line tools such as s3cmd, and desktop clients like S3 Browser. For more configuration options and details, consult the official MinIO documentation.