What is SFTPPlus?
SFTPPlus is provided as a fully supported server and/or client for enterprises who wish to use the security of SSH with open standards together with additional audit and automation for enterprise file transfers. Transfers may be made to/from internal as well as third party external SFTP servers and clients with NO requirement for additional software at the server side. It is designed to be integrated in enterprise systems. SFTPPlus for servers enables both sides to have the same audit and control - if preferred.

Is SFTPPlus supported?
Yes. ProAtria fully supports SFTPPlus and will provide suitable support arrangements to meet your needs – including options for 24x7. ProAtria also fully supports the open source components included.

Do I need to install SFTPPlus at both sides of a transfer?
No. Transfers may be made to/from internal as well as third party external SFTP servers with NO requirement for additional software at the server side. A version of SFTPPlus for servers enables both sides to have the same audit and control - if preferred.

Is there a server as well as client edition available?
SFTPPlus Server edition is also available & enables both sides to have the same audit and control - if preferred.

Which do I need - Server or Client?

Does SFTPPlus have FIPS 140-2 Certification?
We have started the process of obtaining certification for the SFTPPlus Crypto Module under FIPS 140-2 and expect to obtain certification during 2007 for Windows, Unix and Linux.

Can I use pre and post processing with SFTPPlus?
Yes. Typically by incorporating simple commands, bat files or shell scripts.

What authentication options are there?
Currently the options include Windows Services, local or domain users, SSH public/private key certificates and includes a database option.

Is there any centralised administration?
Yes. This is available.

What Alerts and Notifications can I receive with SFTPPlus?
Alerts are raised for specified conditions – options include SNMP, SMTP email alerts etc. The messages may be extended to other systems. Messages are comprehensive and allow for a number of conditions including ‘information’, ‘warning’ (e.g. retry), ‘error’ (e.g. continue), ‘severe error’ (e.g. stop) etc.

What audits and logs are created by SFTPPlus?
Comprehensive audit and logs are available to both event logs and message logs and are routed based on severity.

Can transfers be automated with SFTPPlus?
Yes – SFTPPlus will monitor an 'inbox' directory for a file or wait for a triggering event and then make an automatic transfer to single or multiple destinations of any file. Monitoring may be set to specified intervals.

Can the transfer be guaranteed as successful?
Yes. Retry is until successful or timeout. Additionally SFTPPlus will take a copy of the file and generate a checksum. The copy and checksum will be archived with a date & time stamp and write an entry to a log file. The original file is sent to the SFTP server and optionally will also send the checksum file. See also notifications, messages and audit.

How will I know the file was received?
SFTPPlus has the option to retrieve a response file after a successful upload. e.g. it will wait for 30 minutes, or until triggered, and check for response. If the response file is available, retrieve it and place in 'response' directory. Retry is until successful or timeout.

How do I avoid duplicate names in transfers with SFTPPlus?
The date and timestamp may be added to avoid duplicate names.

Does SFTPPlus support other protocols?
Yes. SFTPPlus also supports FTP and FTPS (FTP over SSL)
+ HTTP and HTTPS 

How does SFTPPlus run?
SFTPPlus client runs as a service.

Does SFTPPlus archive files?
All files are archived with a date & time stamp.

Does SFTPPlus meet FSA regulatory requirements?
SFTPPlus has been developed in close co-operation with a major insurance company to meet FSA requirements, and has sample configurations provided for both the FSA and Council for Mortgage Lending (CML) reporting environments. It is designed to be easily configured for future systems from these and other regulators as well as corporate requirements.

Can I use SFTPPlus for TRS, PSD, STR and other SFTP reporting?
Yes - SFTPPlus is designed to fully support Financial Service Authority (FSA) interfaces for Transaction Reporting System (TRS) Product Sales Data (PSD) and Securities Trades Reporting (Markets) XML documents using the System to System Interface.

Can I use SFTPPlus for HIPAA, SOX and other compliance purposes?
Yes - SFTPPlus is designed to be used in any environment that requires additional audit and management of Secure FTP. Security is met using options including AES & Triple DES - see the encryption options below. The additional audit and other features assists with compliance. 

Can I use SFTPPlus with NHSnet MTAs?
Yes - SFTPPlus is designed to integrate with users of the NHS Net Messaging Service. SFTPPlus integrates with and adds additional automation options for Message Transfer Agents (MTAs). This provides an easy to use and secure method of transferring the data with sufficient security to meet the requirements of privacy of patient identifiable information.

Does SFTPPlus use proprietary protocols?
NO - SFTPPlus uses standard protocols, such as SFTP

What encryption is available?
SFTPPlus supports the standard SSH encryption protocols, including

• AES (Rijndael) - 256, 192, or 128-bit CBC (SSH-2 only)
• Blowfish - 128-bit CBC
• Triple-DES - 168-bit CBC
• SSL in the case of HTTPS and FTPS

Can SFTPPlus co-exist with other products?
Yes - SFTPPlus can co-exist with products such as CONNECT:Direct (NDM, Network DataMover) from Sterling Commerce and XCOM from CA - to provide additional options for enterprise secure file transfer.

Can I customise SFTPPlus
SFTPPlus has many customisation options. Additionally, the source code is included and may be customised as desired.

Can I guarantee the transferred file is intact?
SFTPPlus will generate an md5sum message digest which can be transferred with the original file to verify integrity.

How does SFTPPlus verify server ssh signatures?
SFTPPlus requires the signature of every server to be cached as part of the configuration. This prevents communications with unauthorised servers.

Can I use SFTPPlus to send to anyone?
Yes, but to ensure the system is not abused, the remote systems have to be pre-configured. SFTPPlus is not designed for uncontrolled transfers.

Does SFTPPlus require it's own server?
SFTPPlus is designed to run on an existing server. The overheads are low, and generally the network requirements would be the limiting factor.