Articles and news

New Features

• You can now use PXF / PKCS#12 certificates in SFTPPlus without converting them to the PEM format first. [#2596]
• The HTTP file transfer server web UI now has dedicated ID for each UI element making it easier to implement themes. [web-server][http][https] [#3224]

Defect Fixes

• Documentation for the group's ssh_authorized_keys_path configuration option was updated to specify that reading multiple SSH keys from a single file is not supported. This implementation change was done in version 2.6.0, but the documentation was not updated until now. [server-side] [#1296]
• FTP client transfers no longer create empty files on transfer failures. [client-side][ftp][ftps] [#3006]
• You can now create new SFTP services from the Local Manager web interface. This issue was introduced in version 3.46.0. [server-side][sftp] [#4124]
• When using the client shell, passwords are now masked by default. [security][client-side] [#5213]
• Local Manager's web interface now has an explicit button for disabling a password. In previous versions it was required to type disabled to disable the usage of a password. [manager] [#5236]

You can check the full release notes here.

New Features

• HTTP POST event handler can now be configured to automatically retry on network and HTTP errors. [server-side][http-api] [#2619]
• It is now possible to configure a file transfer service to emit debugging events for the low-level protocol used. [http][ftp][ftps][sftp][scp][server-side] [#2697]
• The Python Extension event handler now handles events on multiple CPUs. In previous versions all events were handled by a single CPU. [#5262]
• A new destination path action named single-file was added to transfer multiple source files as a single destination file. [client-side] [#4054]
• You can now disable the overwriting rule for a transfer destination. In this way, the file is uploaded right away, without doing any extra requests on the server. [client-side] [#4054]
• Debian 9 is now a supported platform. [#3353]

Defect Fixes

• When changing the current folder in FTP, the SFTPPlus server now only checks that the path is a folder and that path traversal is allowed. It no longer tries to see if the operating system allows listing content. Asking the operating system to list content for every target directory could have caused performance issues. [server-side][ftp][ftps] [#2111]
• You can now use a local directory with a large number of files (more than 10.000), as the source for a transfer. [client-side] [#1319]
• The local filesystem source location no longer stops to monitor the source on I/O errors. It will log an error and retry to get the content again after changes_poll_interval seconds. [client-side] [#3350]
• The SysV and OpenRC init scripts now work when executed as root user. This was a defect introduced in 3.42.0. [#3353]

Deprecations and Removals

• The Python Extension event handler no longer takes a parent argument. The events are no longer handled in separate threads. Instead, they are added to a queue to be executed on a dedicate CPU. [#5262]
• Support for Ubuntu 16.04 on ARM64 was removed. [#3353]
• Support for Debian 8 was removed. [#3353]

You can check the full release notes here.

New Features

• You can now configure multiple domains for a free Let's Encrypt certificate using the subjectAlternativeName field. [server-side][ftps][https] [#5108]
• A new event handler of type external-executable was added to execute external scripts or programs. [#5234]
• Windows Server 2019 is now a supported platform. [#5241-1]
• The bundled OpenSSL libraries in Windows, SLES 11, and OS X were updated to versions 1.1.1b, adding support for TLS 1.3. [#5241]

Defect Fixes

• The WebDAV location now ignores HTTP proxy errors when they occur while monitoring a remote SharePoint Online site. [client-side][https] [#5114-1]
• The WebDAV location now works with multiple parallel transfers from the same SharePoint Online source. [client-side][https] [#5114]
• The SFTP and SCP file transfer services will no longer block the whole SFTPPlus process during the SSH handshake. [server-side][sftp][scp] [#5202]

Deprecations and Removals

• Event with ID 20057, emitted when execute_at_startup times out, was removed and replaced by event with ID 20056. [#5234]

You can check the full release notes here.

Connection Security

The connection between your company and DWP is secured using certificate-based mutual TLS authentication (mTLS) (also referred to as two-way authentication). DWP will provide the SSL certificate used by their client, while your company will have to provide the SSL certificate used by your FTPS server.

With SFTPPlus you can use a certificate generated by any certificate authority (public or your private CA).

Integration with the Let's Encrypt Certificate Authority is provided via the HTTP-01 challenge. SFTPPlus can seamlessly obtain and use a certificate from the Let's Encrypt CA. The certificate is automatically renewed.

On top of the security provided by the TLS/SSL layer, username/password credentials are used to identify the requests from DWP.

SFTPPlus can support a multi-channel architecture, allowing you to use the same SFTPPlus server for exchanging files with multiple partners, not only with DWP.

Read more about securing FTPS server with SFTPPlus in our dedicated documentation page.

Client / Server Data Exchange

FTPS is an open standard file transfer protocol built on a client-server model architecture.

The client is the active component which controls when and what type of file transfer operation to perform. The client generates an authenticated connection to the server and ask the server to push or pull files. DWP will act as a client.

The server is the reactive component which controls who can perform file transfer operations and what kind of file operations are allowed. The server stays idle and only becomes active once it receives a connection from the client. Your system will act as a server.

Once the data is pushed by DWP, it will reside as files on your system. From there it will be further processed and consumed by your business system.

ProAtria DWP Expertise

ProAtria, the developer of SFTPPlus, is a long-term partner for the project deployed at DWP. We have helped with the migration from insecure FTP to Explicit and Implicit FTPS systems and with the migration from legacy Solaris-based systems to a modern Linux-based cloud infrastructure.

We are involved in the delivery and maintenance of the Digital Children’s Platform (DOS 012) and the data exchange between DWP and the Scottish Government.

We offer broad expertise into the data exchange with DWP and DVLA. Our customers benefit of help and consultancy for their DWP and DVLA related projects without any additional cost.

Evaluating SFTPPlus MFT

The features listed in this article are just a selected few out of many integration and configuration options that are available today. Feel free to talk to the Support team about your requirements with file transfer software.

SFTPPlus MFT Server supports FTP, Explicit FTPS, Implicit FTPS, SFTP, SCP, HTTP and HTTPS.

SFTPPlus MFT is available as an on-premise solution supported on Windows, Linux, and macOS.

It is also available on the cloud as Docker containers, AWS or Azure instances and many other cloud providers.

Request a trial using the form below.

New Features

• The HTTP/HTTPS file transfer service now supports downloading multiple files at once as a Zip file. [server-side][web-api][http][https] [#5093]
• It is now possible to set up password expiration for accounts and groups. [server-side][security] [#5146]
• It is now possible to configure the preferred size of the group in the SSH Diffie-Hellman group key exchange method. [server-side][sftp][scp] [#5205]
• The file dispatcher event handler now supports the copy action. This will copy the source file to one or more destinations, without removing the source file. [server-side][client-side] [#5210]
• The file dispatcher event handler now supports the rename action. This will rename the source file (with an atomic move operation) without overwriting an existing file. [server-side][client-side] [#5220]

Defect Fixes

• An event is now emitted when a file is closed after it was open for reading through the HTTP file transfer service. [server-side][http][https] [#5093]
• The HTTP/HTTPS file transfer service now responds with 401 Unauthorized for requests made with 100 Continue when no credentials are provided in the request. [server-side][http][https] [#5223]

You can check the full release notes here.