Cyberduck

With Cyberduck 9.5 with have adopted the user interface for Liquid Glass, but the application icon with the duck objects tinted colours always remaining yellow and escapes the squircle jail imposed by default on application icons on macOS 26. We posted about this on @cyberduck back in September last year.

Post by @cyberduck@fosstodon.org

View on Mastodon

With the recent blog post Free the Icons from Paul Kafasis this has again gained some traction from other developers and we sure hope others join like the fine folks from Cryptomator. The application icon of Mountain Duck concedes we have to admit.

For the technically interested, this is implemented as a simplistic Dock Tile Plugin.

Cyberduck 9.5 adopts user interface changes known as Liquid Glass in macOS Tahoe. Besides rounded corners, the update also includes other refinements the list of bookmarks and editing connection details in the bookmark window.

Connect Options

Controls for unavailable connect options depending on the current protocol selection are hidden but the Open Connection window now features the all available options likewise the Edit Bookmark window. Non-frequent options have been moved to a More Options tab. Additionally a Connect button is available when editing a bookmark.

Browser Window

in the main window, the navigation bar is only shown in list and outline view but not when not applicable when displaying bookmarks. Additionally a progress indicator is shown for the bookmark when a connection is being opened.

You can read the full details in the changelog.

Managing access to Amazon S3 across multiple AWS accounts and users has traditionally required juggling access keys, secret credentials, and complex IAM policies. With support for AWS IAM Identity Center (formerly AWS Single Sign-On) now available in Cyberduck 9.5.0 and Mountain Duck 5.3.0, connecting to S3 has never been easier or more secure.

What is AWS IAM Identity Center?

AWS IAM Identity Center is AWS’s centralized access management solution that lets users sign in once using their existing corporate credentials—whether that’s through Okta, Microsoft Entra ID (formerly Azure AD), or other identity providers. Instead of managing permanent access keys, users get short-lived credentials that automatically expire, significantly improving your security posture.

Why Use IAM Identity Center with S3?

Traditional S3 access requires creating and managing AWS access keys for each user. These long-lived credentials pose security risks if accidentally exposed or shared. IAM Identity Center solves this by:

• Single Sign-On: Users authenticate once with their corporate credentials
• Short-lived credentials: Temporary credentials that automatically expire and rotate. No more permanent access keys to manage or rotate
• Centralized management: Control access across multiple AWS accounts from one place

Getting Started

Setting up IAM Identity Center authentication for S3 requires two main steps:

1. Configure AWS IAM Identity Center

First, enable IAM Identity Center in your AWS account and configure your identity source. You can use AWS’s built-in directory or connect to an external identity provider like Microsoft Entra ID or Okta. Create a permission set that defines what S3 resources users can access—for example, read-only or full access to specific buckets. Add users through IAM Identity Center (or sync them from your external identity provider) and assign them to AWS accounts with the appropriate permission sets. Users will receive an invitation to set up their access to the AWS access portal.

3. Connect in Cyberduck or Mountain Duck

Creating a connection is straightforward:

1. Create a new bookmark and select AWS S3 (IAM Identity Center) from the protocol dropdown
   
2. Provide your SSO region and start URL when prompted
3. Authenticate through your web browser using your corporate credentials
4. Approve access to Cyberduck or Mountain Duck in the AWS portal
5. Choose the AWS Account ID shown when your user has access to multiple accounts and the Permission Role Name if more than a single permission set is configured

The browser will redirect back to the application, and you’re connected—no access keys to copy or store.

Streamlined Workflow with AWS CLI Integration

For teams already using the AWS CLI, Cyberduck and Mountain Duck can read configuration directly from your ~/.aws/config file. Simply configure your profile once with aws configure sso, allowing you to skip the manual input.

Get Started

AWS IAM Identity Center support is available now in Cyberduck 9.5 and Mountain Duck 5.3. For detailed setup instructions and configuration options, check out our complete tutorial.

This issue has been resolved as of September 11th with the OAuth App Verification completed including the paid CASA assessment.

To access Google Drive or Google Cloud Storage using Cyberduck or Mountain Duck we have registered an OAuth 2.0 Client ID with Google that is required to show users a consent screen to access files from these cloud storage services using the respective APIs.

Google recently blocked the consent screen and now shows the following error when trying to open a new connection:

This app tried to access sensitive info in your Google Account. To keep your account safe, Google blocked this access.

We are aware of the problem and are currently working on getting the consent screen re-approved by Google.

No user data is collected or shared when you access your data in Google Drive or Google Cloud Storage using Cyberduck or Mountain duck. We do not transfer or disclose your information to third parties. Any data accessed is processed solely on your device.

As a workaround you can register your own Custom OAuth 2.0 Client ID for Google Cloud Storage and Google Drive and using with a custom connection profile instead.

Cyberduck 9 adds a new custom file versioning feature for protocols with no native versioning support, such as FTP/SFTP and WebDAV.

The feature is added as a security measure to reduce the risk of file loss when editing changes. You can enable the option by default in the Editor tab in Preferences.

The versions can be previewed, deleted or restored in Edit → Info → Versions with the same user interface as when working with revisions from protocols with native versioning support such as a versioned bucket in S3.

Technically instead of overwriting files, previous versions are moved to a folder named .duckversions created adjacent to the edited file. The documentation has more details.