SFTPPlus MFT Release 6.1.2

SFTPPlus MFT version 6.1.2 is now available.

Security fixes ​

HTTP and HTTPS services configured for access through a reverse proxy now reject direct OpenID Connect login requests that lack the required proxy origin headers, even when a Referer header is present. If you need both direct and proxied access, configure two separate services: one with client_forwarded_header empty for direct access, and another with forwarded headers configured for the reverse proxy.

Tracebacks, the detailed error reports used for troubleshooting, are now excluded from event data and default email, log, and webhook output to prevent disclosure of sensitive information. You can still include them explicitly in an event handler template using {tb}.

Vault items now report an error when their contents cannot be parsed into usable data. Previously, trusted certificate and pinned key items containing text without usable PEM content could silently disable TLS server identity verification, allowing a connection to an untrusted FTPS or HTTPS server.

Web Manager and transfer schedules ​

The Web Manager now provides permission selectors and an ordered table of path rules for account and group file access. A virtual folder editor separates virtual paths from local paths and includes a local filesystem browser. Group settings also provide a list for adding and removing directories in the home folder structure.

Transfer schedules can now be configured with start and stop actions, day selections, and a time picker. You can schedule transfers on the 28th through 31st, or on the last or second-last day of each month. Dates that do not occur in a particular month are skipped.

Each administrator can save a preferred color theme in their settings, which is applied automatically after login. The activity log now shows the estimated country and network organization for public IP addresses in newly recorded events.

Kubernetes and monitoring ​

A Helm chart is now available for installing SFTPPlus MFT on Kubernetes. Azure BLOB, Azure Files, and Exchange Online locations support Azure Workload Identity, allowing Kubernetes deployments to access these services without storing a client secret or storage access key.

The Web Manager exports Prometheus metrics at /metrics, including process start time, application metadata, resource usage, and reactor delay. Standard output and local file event handlers now support Logfmt, a format that records log fields as key and value pairs. New standard output loggers include severity and peer address fields in their default Logfmt output for integration with Grafana and Loki.

Cluster nodes now identify themselves to the controller using their configured name, or the local hostname when no name is set. Administrators can test controller connections and configure trusted certificates during initial setup or from the synchronization resource in the Web Manager.

Performance and reliability ​

SFTP and SCP services now have configurable SSH receive windows and maximum packet sizes to help improve uploads over high-latency connections. The default receive window has increased from 128 KiB to 2 MiB.

This release also reduces CPU usage when viewing component status and configuration or formatting log entries. Monitoring large folders is faster when the location does not provide file identifiers, and event handling uses less memory by generating JSON data only when needed.

AS2 uploads no longer fail with Context was already finalized when a transfer pauses and resumes. Services release their listening ports after a failed startup, so they can restart once the configuration is corrected. Missing event data fields no longer interrupt text or CSV logging.

Before upgrading ​

Review custom event handlers and account settings before upgrading.

Account information is no longer included in data.avatar or {data_json}. Use {account} or {account.ATTRIBUTE}, such as {account.name}, in event handler templates. Existing handler INI templates are migrated automatically. Tracebacks must be requested explicitly with {tb}.

Accounts without an explicit create_home_folder setting now inherit their primary group's value, instead of defaulting to No. Review this setting if you rely on accounts not creating home folders.

Account and group permissions are now configured separately using default_permissions and path_permissions. The event handler servers filter is replaced by pool_uuids, with existing values migrated automatically. Log messages no longer contain newline characters; carriage returns and line feeds are replaced with spaces. Python API extensions that modify event data in getConfiguration() must first copy it, as the supplied data is now read-only.

SFTPPlus MFT 6.1.2 is available for download. Customers should contact our support team to request a download link.

This article provides a brief overview of the release. For the full list of changes, see the 6.1.2 release notes.

Banner photo by Ankush Minda on Unsplash.