SFTPPlus can be configured to allow both application specific accounts as well as operating system accounts or accounts supplied by third party identity providers.
SFTPPlus specific / application / virtual accounts are defined inside the main configuration file.
Account for which the authentication is provided by the operating system can also be defined inside the main configure file to augment or overwrite the account configuration provided by the operating system. Ex you can authenticate an account using the operating system, but once authenticated use a different home folder, other than the one provided by the operating system.
Each account has a dedicated folder, called the home folder, which can be accessed using one of the available file transfer protocols.
For security reasons, by default, SFTPPlus will restrict access of each user to only the files and folder located inside the home folder.
Accounts can be added or changed by editing the configuration file.
Configurations for each account are grouped inside an account section. A section name is prefixed by an accounts/ text followed by the account’s universally unique identifier (UUID), all surrounded by square brackets.
The account’s UUID can be any unique string used to identify the account. Once defined, the UUID should not be changed.
For more information about UUIDs, please see the dedicated UUID documentation.
The following example defines two accounts, one called john, which is an application type account, and another named anna, which is an account authenticated by the operating system:
[accounts/92ad5b32-d8d7-4ed8-94e1-dbb9f01383f4]
name = john
type = application
group = 9e3c5562-9b86-43da-a984-1d8751f2f060
enabled = Yes
password = some_password
home_folder_path = /path/to/john
[accounts/745fff10-4370-4d75-a172-21819046c76f]
name = anna
type = os
group = 01d2e30b-05f7-40c3-a86d-58744995970d
enabled = Yes
home_folder_path = /path/to/anna/files
Each configuration option available for an account or a group is explained in the following sections.
Adding a new account is done by creating a new section inside the configuration file.
For example, to add a new account named mark
[accounts/514e5b73-e9a4-46ce-a9c0-96c3d7eabf3b]
name = mark
enabled = Yes
type = application
group = fb40336d-8e5b-4275-950e-5f76fc387281
description = DESCRIPTION_OR_MORE_DETAILS
home_folder_path = /PATH/TO/USER/HOME
password = PASSWORD
Application accounts are special accounts only available inside the SFTPPlus application.
All application accounts will be mapped inside the operating system to the operating system account configured using the [server] account configuration option.
Application accounts will always be locked inside their home folder and will not have access to files outside the home folder.
If no group is defined for an application account, it will be attached to the DEFAULT_GROUP group.
Warning
It is highly recommended to define an explicit group (other than the DEFAULT_GROUP) for each application account. This will make the configuration file much easier to understand by removing any implicit behaviour associated with an unspecified group.
SFTPPlus allows operating system accounts to access their files once they are authenticated by providing a set of valid credentials.
While working with files, the access rights will be imposed by the operating system permissions for those files.
When an operating system account creates new files or folders, the ownership for those files or folders will be set to that account.
Note
On Windows, if an account is a member of the Administrators group, the owner will be set to the Administrators group.
On Windows XP and 2003, this behaviour can be controlled via the security policy System objects: Default owner for objects created by members of the Administrators group.
On Windows 2008, members of the Administrators group will always create new files owned by the Administrators group, and there is no option to configure this behaviour.
For operating system accounts, SFTPPlus will validate the user’s credentials against the operating system authentication mechanism.
An operating system account can be configured to use the same home folder as the one provided by the operating system. Or it can be configured to use a custom home folder, specific for file transfer operations.
The server allows the authentication of operating system accounts not defined in the configuration file. These accounts are associated with the DEFAULT_GROUP group, and the group’s properties are applied.
For Domain Controller accounts, the user name must be provided in the user principal name (UPN) format: USERNAME@EXAMPLE.COM
Most of the configuration options available for an account are optional. When a configuration option is not explicitly defined inside an account section, the default value for that option will be applied.
Some of the configuration options can also take the Inherit value. In this case, the value for this option will be defined based on the group configuration. More information about available group options can be found in the Groups configuration documentation.
Here are some examples:
[accounts/92ad5b32-d8d7-4ed8-94e1-dbb9f01383f4]
name = john
enabled = yes
type = application
group = ccac2941-261d-4797-af5f-b4fd1453bf59
password = john_s_password
home_folder_path = c:\Users\John\transfer_files
create_home_folder = yes
ssh_authorized_keys_path = c:\Users\John\authorized_keys
[accounts/514e5b73-e9a4-46ce-a9c0-96c3d7eabf3b]
name = mark
enabled = yes
type = os
group = 0a3f3aa7-50d2-44ef-9456-4f0beb69cf7d
home_folder_path = /home/mark/transfer_files
create_home_folder = Inherit
ssh_authorized_keys_path = /home/mark/.ssh/authorized_keys
[accounts/459245-7ea4-49ce-e4c0-98d3d7eabf3b]
name = mike
enabled = yes
type = application
group = ccac2941-261d-4797-af5f-b4fd1453bf59
home_folder_path = /home/mike/
ssh_authorized_keys_content = ssh-rsa AAAAB3NzaC1yc2EAAAADAQAB mike@comment
| Default value: | ‘’ |
|---|---|
| Optional: | No |
| From version: | 2.0.0 |
| Values: |
|
| Description: | Human-readable short string used to identify this account. |
Note
It is used as login name in the authentication process.
| Default value: | Yes |
|---|---|
| Optional: | Yes |
| From version: | 1.6 |
| Values: |
|
| Description: | This option specifies whether or not this account is enabled. This option is overwritten by the group configuration option. If the group to which this account belongs is disabled, the account will also be disabled, no matter what value is defined in the account’s configuration option. |
| Default value: | application |
|---|---|
| Optional: | Yes |
| From version: | 1.6 |
| Values: |
|
| Description: | This option specifies the type of the account.
|
| Default value: | DEFAULT_GROUP |
|---|---|
| Optional: | No |
| From version: | 1.8.2 |
| Values: |
|
| Description: | This option specifies the group to which this account is associated. The value is the group’s UUID and not the group’s name. This allows renaming the group without having to update the configuration for all the accounts associated with the group. |
| Default value: | ‘’ |
|---|---|
| Optional: | Yes |
| From version: | 1.7 |
| Values: |
|
| Description: | This is a human-readable text that describes the entity using this account or the purpose of the account. Example: [accounts/92ad5b32-d8d7-4ed8-94e1-dbb9f01383f4]
name = john
description = Incoming files from John Doe as part of ACME Inc.
|
| Default value: | Inherit |
|---|---|
| Optional: | Yes |
| From version: | 1.6 |
| Values: |
|
| Description: | This option specifies the base path to the account’s home folder. The home folder is used as the initial folder for new connections. When defined, it should be defined as an absolute path. When this option is set to Inherit, the value defined for the account’s group will apply. For a better understanding, please follow the explanations and examples on proprieties inheritance. Warning The ${OS_HOME} option is not available for Windows XP and Windows Server 2003. On these particular systems, you need to configure an explicit home folder path. It is available on Windows 2008 and above. For domain accounts, the server cannot automatically create missing Windows home folders, also known as user profiles. Because of this, you cannot use ${OS_HOME} placeholder when configuring the home_folder_path for a domain account. For domain accounts, a regular folder can be set as home_folder_path. The folder can be automatically created, just as for regular accounts. |
| Default value: | Disabled |
|---|---|
| Optional: | Yes |
| From version: | 1.7.0 |
| Values: |
|
| Description: | This option specifies whether or not the server will permit access using a list of public SSH keys retrieved from the specified file. More details about SSH key authentication can be found in the dedicated section. To disable reading SSH public keys from local files, leave it empty or set to Disabled. This feature is not available in Windows for local or domain accounts. Use application accounts for implementing SSH key-based authentication on Windows. When this option is set to Inherit, the value defined for the account’s group will apply. For a better understanding, please follow the explanations and examples on proprieties inheritance. |
| Default value: | Disabled |
|---|---|
| Optional: | Yes |
| From version: | 2.9.0 |
| Values: |
|
| Description: | This option specifies the list of valid SSH public keys for this account. To disable reading SSH public keys from this configuration option, leave it empty or set it to Disabled. You can configure multiple public keys in the following way: ssh_authorized_keys_content =
ssh-rsa KEY_CONTENT_1 user1@comment
ssh-dsa KEY_CONTENT_2 user2@comment
Warning Public keys must be configured, one key per line and in OpenSSH format. |
| Default value: | Yes |
|---|---|
| Optional: | Yes |
| From version: | 1.8.1 |
| Values: |
|
| Description: | Allow this account to authenticate using SSL certificates. Certificates need to be issued using the same Common Name field (CN) as the account name. If SSL certificate-based authentication is not enabled, accounts will have to use other means of authentication. When this option is set to Inherit, the value defined for the account’s group will apply. |
| Default value: | No |
|---|---|
| Optional: | Yes |
| From version: | 1.6.0 |
| Values: |
|
| Description: | This option specifies whether or not the server should create the home folder for an account, in the case that it is missing. If this option is set to No, the server will not allow users for which the home folder is not already created. When set to Yes, the server will try to create missing home folders for users that are successfully authenticated. For application accounts, new home folders are created using the same account under which the server is executed. They will be owned by the server’s service account. For operating system accounts, the home folders are owned by the associated OS accounts. On Windows they are created by the OS together with the associated Windows Profile. On Unix they are created by the root account, and the permissions are changed to the associated OS account. Note On Windows operating systems, for domain accounts for which home_folder_path is defined as ${OS_HOME}, the server will not be able to create a missing home folder. The server will still be able to create missing home folder when using custom home folder paths. |
Some configuration options are only available for application accounts.
| Default value: | Disabled |
|---|---|
| Optional: | Yes |
| From version: | 1.6.0 |
| Values: |
|
| Description: | This option specifies the password used for authenticating this account. It can be stored as a plain text password or as an encrypted password using the cryptographic hash function SHA-256. In order to make use of the secure hash algorithm, please check how to generate encrypted passwords using admin-commands. When the password is set to Disabled or left blank, the account will not be able to authenticate, even if the enabled option is set to yes. |
Note
The password is ignored for accounts of type = os.
Warning
When using plain text passwords, make sure only authorized users have read access to the configuration file. It is important to change the permission for the configuration file to allow read and write access only for the account under which the server is running.
Note
When FTPS SSL certificate-based authentication or key-based SFTP / SSH authentication are enabled, the password value can be set to Disabled.
A few configuration options are only available for operating system accounts.
| Default value: | Yes |
||
|---|---|---|---|
| Optional: | Yes |
||
| From version: | 1.6 |
||
| Values: |
|
||
| Description: | Specify whether to restrict file system access to the account’s home folder. When accounts are locked inside the home folder, access to files and folders outside the home folder path will be denied, and the home folder path will be the root of the available file system.
On Unix If the user’s home folder is /home/some_user/ and the user is locked inside the home folder, the home folder path will become the root folder visible to the client. In this case, when a client tries to list the content of the folder ‘/tmp’, this request will be mapped to ‘/home/some_user/tmp’ on the local file system. If the user is not locked inside the home folder, a request to list the ‘/tmp’ folder will be mapped to the ‘/tmp’ folder on the local file system. On Windows: If the user’s home folder is C:Userssome_user and the user is locked inside the home folder, the home folder path will become the root folder visible to the client. In this case, when a client tries to list the content of the folder ‘/Temp’, the request will be mapped to ‘C:Userssome_userTemp’ on the local file system. If the user is not locked inside the home folder, a request to list folder ‘/C/Temp’ will be mapped to ‘c:Temp’ folder on the local file system. |
| Default value: | ${DEFAULT_OS_USER} |
|---|---|
| Optional: | Yes |
| From version: | 1.6.0 |
| Values: |
|
| Description: | When the server is configured to automatically create missing home folders, this option specifies who should be the owner of the newly created folder. When this option is set to ${DEFAULT_OS_USER}, the folder owner will be set to the default value specified by the operating system. When this option is set to Inherit, the value defined for the account’s group will apply. |
| Default value: | ${DEFAULT_OS_GROUP} |
|---|---|
| Optional: | Yes |
| From version: | 1.6.0 |
| Values: |
|
| Description: | When the server is configured to automatically create missing home folders, this option specifies what group should be associated with the newly created folder. When this option is set to ${DEFAULT_OS_GROUP}, the folder group will be set to the default value specified by the operating system. Note On Windows operating system, ${DEFAULT_OS_GROUP} is defined as Users group. Please contact us in the case that you need a different behaviour. When this option is set to Inherit, the value defined for the account’s group will apply. |