An authentication method configuration provides the required information to allow SFTPPlus to use a specific method in order to authenticate accounts.
You can define multiple authentication methods. You can configure the order in which these methods are used.
Consult the type configuration option to see the list of supported authentication methods.
Adding a new authentication method is done by creating a new section inside the configuration file. The name of the section should be prefixed with authentications/ and followed by the method’s UUID.
The method’s UUID can be any unique string used to identify the authentication method. Once defined, the UUID should not be changed.
For more information about UUIDs, please see the dedicated UUID documentation.
For example, to add a new authentication method of type http called First tier partners
[authentications/b904ed23-a234-4ccf-8abd-edcae4d3324f]
name = First tier partners
description = Authentication based on the DUSI web application.
type = http
Once defined, authentication methods require explicit activation by defining the ordered list of active authentication methods for the [server] authentications configuration option.
In this way, you can define multiple authentication methods and set their priorities. Once an account is successfully authenticated using a set method, the server will not try the remaining methods.
The following example will define a configuration in which the authentication with UUID b904ed23-a234-4ccf-8abd-edcae4d3324f is tried first. If the first method cannot authenticate the account, the server will try to authenticate it using the method with UUID ed123e-4d4724f:
[server]
name = VSP server
description = Frontend for FG partners.
authentications = b904ed23-a234-4ccf-8abd-edcae4d3324f, ed123e-4d4724f
Each authentication method configuration has the following options:
| Default value: | ‘’ |
|---|---|
| Optional: | Yes |
| From version: | 2.10.0 |
| Values: |
|
| Description: | Human-readable short text used to identify this method. |
| Default value: | ‘’ |
|---|---|
| Optional: | Yes |
| From version: | 2.10.0 |
| Values: |
|
| Description: | Human-readable text that describes the purpose of this authentication method. |
| Default value: | ‘’ |
|---|---|
| Optional: | No |
| From version: | 2.10.0 |
| Values: |
|
| Description: | This option specifies the type of the method. Each type has a set of specific configuration options |
An application authentication method can be used to authenticate users based on accounts defined in the configuration file of SFTPPlus.
It will authenticate accounts of type application.
For now, no other options are provided for this authentication method.
An os authentication method can be used to authenticate users based on the authentication methods provided by the operating system.
Attention
On Linux and Unix, this authentication method can only be used when the SFTPPlus service is started as root.
You can overwrite some of the account’s settings (e.g. home folder path), by defining an account of type os inside the configuration file.
The os authentication method will authenticate the following account types:
Note
On AIX, the /etc/security/passwd file will be used together with the /etc/passwd file.
On systems supporting PAM, PAM can also be used for authenticating users with username and password credentials.
On many Unix and Linux systems, PAM is used for enabling various authentication methods, such as LDAP, PKCS#11 smart cards, or fingerprint authentication.
When the PAM authentication request returns PAM_SUCCESS, the account is authorized. Any response other than PAM_SUCCESS will reject the account.
PAM only handles authentication. The account configuration is retrieved using the same generic OS API.
Note
SFTPPlus’ pam authentication method will only use PAM for the authentication operation. PAM is not used for managing accounts, sessions, or passwords. Please get in touch with us if you need to integrate PAM accounts and session management with SFTPPlus.
| Optional: | yes |
|---|---|
| Default value: | fallback |
| Values: |
|
| From version: | 3.3.0 |
| Description: | Defines how to use PAM for for authenticating accounts using username and password credentials. The default mode is fallback. In this mode it will first try to authenticate accounts based on the /etc/passwd file. If the password is set in the operating system as one of the following x, NP, *NP* or *, it will continue to authenticate with PAM. In exclusive mode, it will exclusively use PAM for username and password authentications. Set it to disabled to completely disable PAM usage. Note On OS X, this option is ignored and the exclusive mode is used instead. Open Directory local accounts are always authenticated using PAM because OS X does not support the /etc/passwd based authentication. Note On Windows this option is always disabled, as SFTPPlus has no support for PAM on this platform. |
| Optional: | yes |
|---|---|
| Default value: | login |
| Values: |
|
| From version: | 3.3.0 |
| Description: | Name of the PAM service used for account authentication requests. |
When SFTPPlus is installed on a machine belonging to a Domain Controller, it can be configured to allow accounts from a Domain Controller to access the files located on the server. These accounts are authenticated using the os authentication method.
For Domain Controller accounts, the user name must be provided in the user principal name (UPN) format:
USERNAME@EXAMPLE.COM
Note
Active Directory accounts are only available when SFTPPlus is running on a Windows operating system. If you want to allow Active Directory accounts to access an SFTPPlus instance running on Unix, Linux, or another operating system, please contact our support team.
The ldap authentication method can be used to authenticate application type accounts using the information provided by a remote LDAP server.
Simple BIND operation is used for authentication an account against the LDAP server in order to validate the credentials received from a file transfer client session.
When an authentication request is made for transfer client session, SFTPPlus will use the provided credentials (username and password) and forward them to the configured LDAP server for validation.
Attention
The LDAP authentication method is a terminal method. Once the authentication chain has reached it, it will either accept or reject the credential and will not allow any other authentication to continue with validating the credentials.
Note
BIND operation over SSL or SASL PLAIN BIND operation are not yet supported. If you require one of these BIND operations please contact our support team.
Note
Only LDAP v3 is supported. If you require a different version please contact our support team.
To perform a successful authentication, SFTPPlus will connect to the LDAP server, BIND the connection to validate the credentials, retrieve the LDAP entry for the same DN used to bind the connection and then close the connection.
Successfully authenticated accounts are associated to the default group.
| Optional: | No |
|---|---|
| Default value: | N/A |
| Values: |
|
| From version: | 3.13.0 |
| Description: | Host name, domain name or IP address used to connect to the remote LDAP server. Note If possible, consider defining this option using an IP address. This will improve the performance as a DNS query will not be required before doing each authentication request. |
| Optional: | Yes |
|---|---|
| Default value: | 389 |
| Values: |
|
| From version: | 3.13.0 |
| Description: | Port number used by the remote LDAP server to receive client connections. |
| Optional: | No |
|---|---|
| Default value: | N/A |
| Values: |
|
| From version: | 3.13.0 |
| Description: | Base DN used to generate the distinguished name associated with the account which needs to be authenticated. A distinguished name used for the bind (authentication) operation is generated using the following method: cn=USERNAME,BIND_DN_VALUE For example if bind_dn is defined as ou=det,dc=example,dc=com and an authentication is requested for username John, the LDAP authentication (bind) operation is done for DN: cn=John,ou=det,dc=example,dc=com. |
| Optional: | Yes |
|---|---|
| Default value: | homeDirectory |
| Values: |
|
| From version: | 3.13.0 |
| Description: | Name of the attribute used to retrieve the home folder path for the account which is authenticated. When the LDAP entry associated with the authenticated account has no such attribute or the attribute’s value is empty the authentication will fail. Leave it empty to not retrieve the home folder path from the LDAP entry, but rather inherit the value from the associated group. |
An http authentication method asks a remote HTTP resource to authenticate an account and provide the account’s configuration.
To get more details about the request format and the expected result, please see the dedicated HTTP authentication protocol documentation.
Warning
Account credentials and account configuration are transferred using unsecured HTTP connections. Use this method only over private networks.
| Optional: | No |
|---|---|
| Default value: | N/A |
| Values: |
|
| From version: | 2.10.0 |
| Description: | Full URL of a resource used to authenticate an account. |
A deny-username authentication method can be used to block/deny authentication for a configured list of denied users.
Tip
Add this authentication method as the first one in the list of active authentication methods to make sure the users are not authenticated earlier by other authentication methods.
| Optional: | Yes |
|---|---|
| Default value: | Empty |
| Values: |
|
| From version: | 3.0.0 |
| Description: | Comma-separated list of user names denied by this authentication method. The check is done in case-insensitive mode, by comparing against the lower-case name. User names should be defined in lower-case. |
An ip-time-ban authentication method can be used to block/deny authentication requests coming from a specific IP address, if they generate a number of consecutive authentication failures.
The ban is active for a time interval, after which authentication requests made from the IP address are accepted again.
Tip
Add this authentication method as the first one in the list of active authentication methods to make sure the users are not accepted earlier by other authentication methods.
Note
When this authentication method is restarted it will reset its internal record of source IP addressed which have previously generated failed authentication requests.
Warning
Don’t use this method if SFTPPlus is behind a Proxy/Gateway or any other network device which does not preserve the source IP address of the initial authentication request.
The ban applies to the source IP address used to initiate the authentication requests.
If SFTPPlus server is behind a Proxy/Gateway, all requests will come from the gateway’s own IP address.
Warning
When using this method, please check that your network is not vulnerable to IP address spoofing .
| Optional: | Yes |
|---|---|
| Default value: | 3600 |
| Values: |
|
| From version: | 3.2.0 |
| Description: | Number of seconds for which authentication requestes from the source IP are denied. Default interval is 1 hour. |
| Optional: | Yes |
|---|---|
| Default value: | 5 |
| Values: |
|
| From version: | 3.2.0 |
| Description: | Number of consecutive failed authentications which will result in blocking the source IP. |
An anonymous authentication method can be used to authenticate a specific application type account by ignoring the provided password or any other credential.
This authentication is implemented based on the RFC 1635 but it can also be used for SFTP/SCP or HTTP/HTTPS services.
Once authenticated, the anonymous account will have the same permissions as the account with which it’s associated. The audit events are recorded under the associated account name and not the anonymous account.
The anonymous account is locked inside the home folder and will have full access to all files and directories located in the home folder, just like a normal application account.
| Optional: | No |
|---|---|
| Default value: | N/A |
| Values: |
|
| From version: | 3.2.0 |
| To version: | None |
| Description: | This is the UUID of the application account associated with the anonymous account. |
SFTPPlus can be configured together with a legacy centralized SFTPPlus WebAdmin instance. SFTPPlus will allow SFTPPlus WebAdmin’s global users to be authenticated and to use the services provided by the server.
The SFTPPlus WebAdmin needs to be installed and configured prior to using it alongside SFTPPlus. For more information regarding the SFTPPlus WebAdmin installation, please consult the installation guide for SFTPPlus WebAdmin.
To enable global WebAdmin users, create a new authentication method using the legacy-webadmin type, and define the url parameter accordingly.
Global WebAdmin users having the User Alias configuration option set are handled as os accounts, while those not having it configured are handled as application accounts.
Note
The SFTPPlus WebAdmin global account configuration option User Alias is only supported when SFTPPlus runs on Linux or Unix and it is started as root.
| Optional: | No |
|---|---|
| Default value: | N/A |
| Values: |
|
| From version: | 3.0.0 |
| To version: | None |
| Description: | This is the URL to the installed SFTPPlus PHP WebAdmin version 1.5.2 or newer. SFTPPlus PHP WebAdmin versions prior to 1.5.2 might also work. Please get in touch with us to check if your WebAdmin version is supported. It is used to allow SFTPPlus WebAdmin’s global users to use this server. For example, if SFTPPlus Webadmin is running on localhost on port 8080, installed in the /SFTPPlus path, you should use the following configuration: url = http://localhost:8080/SFTPPlus
|