1. Start Page
  2. 4. Configuration Instructions
  3. 4.3. Local Configuration ...

4.3. Local Configuration Manager

4.3.1. Introduction

The Local Configuration Manager can be configured in a similar way to any other service provided by SFTPPlus.

This page describes configuring the Local Manager service. For information about using the service, please see (the page on Local Manager operation).

The Local Manager service must be accessed over HTTPS and is enabled by default on port 10020 of the local interface, thus being available only for local connections, typically at https://127.0.0.1:10020.

Note

Since the HTTPS connection used by the Local Manager is secured using a self-signed SSL certificate; all web browsers will prompt to validate the server identity.

You can configure the Local Manager to secure the HTTPS connection using a different SSL certificate, issued by a trusted certificate authority.

By default the Local Manager provides a dedicated administrator account which is not tied to the operating system. More administrator accounts can be created using the Local Manager or by manually editing the configuration file, please see (the page on configuring administrators).

Note

The default account name is admin and the default password is pass.

Danger

This default administration account is provided for testing and debugging purpose. For production usage it is highly recommended to change the account name and password or to disable the account.

Besides allowing administrative access to the default application administrator account, the default configuration also allows administrative access for all users from the operating system’s groups Administrators or adm, as these are the default administrative groups for Windows or Unix/Linux operating systems.

The standard configuration file is pre-configured with a Local Manager service having the DEFAULT-MANAGER UUID. To prevent accidental removal, this service cannot be removed from the Local Manager GUI. You can still remove it by manually editing the configuration file.

4.3.2. Disable or stop the main Local Manager service

SFTPPlus allows creating multiple instances of the Local Manager service, as for any file transfer service.

To prevent accidentally deleting or disabling the main Local Manager service with the DEFAULT-MANAGER UUID, these operations are restricted from the local manager itself.

To disable the main Local Manager service, restart the server after amending the configuration file to contain the following options:

[services/DEFAULT-MANAGER]
enabled = No

To re-enable the service, restart the server after amending the configuration file as below:

[services/DEFAULT-MANAGER]
enabled = Yes

After authentication in the Local Manager, an administrator can configure the Local Manager from within the web interface.

The rest of this page describes configuration options specific to the Local Manager, as defined in the configuration file.

Local Manager is configured just like any other service provided by the server, and configuration options are stored inside the configuration/server.ini configuration file.

For general information about configuring a service, please see the services configuration page.

4.3.3. ssl_certificate

Optional:

Yes
Default value:

no-certificate-defined
Values:
  • Path to the SSL certificate file used by the service.
From version:

1.6.0
To version:

None
Description:

The certificate file can contain both the certificate and the private key, in which case you don’t need to set the path to the private key file.

4.3.4. ssl_key

Optional:

Yes
Default value:

Disabled
Values:
  • Path to the SSL key file used by the service.
  • Disabled - Use the key provided by the certificate file.
From version:

1.6.0
To version:

None
Description:

If the file specified by the ssl_certificate option already contains the private key, this option can be omitted.

4.3.5. ssl_key_password

Optional:

Yes
Default value:

Disabled
Values:
  • Password as text.
  • Disabled - Don’t use a password for the private key file.
From version:

1.7.19
To version:

None
Description:

This is used when the private SSL key is stored as an encrypted file.

4.3.6. ssl_certificate_authority

Optional:

Yes
Default value:

Disabled
Values:
  • Path to the PKI certificate file or folder of PKI certificate authorities.
  • Disabled
From version:

1.6.0
To version:

None
Description:

Only clients using certificates signed by one of these certificate authorities will be permitted to connect to this server using secured connections.

The certificate authority file should be stored in PEM format.

Leave it empty or set it as Disabled to disable checking the issuer for peer’s certificates.

When certificate authority check is disabled, connection peers are not required to send a certificate. If the peer sends a certificate, it is ignored.

4.3.7. ssl_certificate_revocation_list

Optional:

Yes
Default value:

Disabled
Values:
  • relative path on local filesystem
  • absolute path to local filesystem
  • http://example.com/some.crl
  • file:///unix/absolute/test-ca.crl
  • file://unix/relative/test-ca.crl
  • file://c:windowsabsolutetest-ca.crl
  • file://windowsrelativetest-ca.crl
  • comma separated list of CRL locations
  • crl-distribution-points
  • Disabled
From version:

1.6.0
To version:

None
Description:

It defines the locations from where one or more CRLs will be loaded.

Multiple CRLs are defined as a comma separated list.

It supports local files in both absolute and relative paths.

Retrieving the CRL over HTTP is also supported. The HTTP request is done using non-persistent HTTP/1.1 connections.

CRL distribution points (CDP) are supported by using the crl-distribution-points configuration value.

When CRL distribution points are configured, the server-side certificate defined at ssl_certificate needs to have the CDP extension. The CDP advertised in the server-side certificate is loaded at startup in order to validate the configuration.

The distribution points configuration is mutually exclusive with local file or HTTP url configurations. When the certificate revocation list is configured to use CDP, all other configured CRL location are ignored.

Note

HTTP redirection is not yet supported.

Set it to Disabled, to disable certificate revocation checks.

The certificate revocation list can only be used when the service is configured with CA certificates stored in a single file in PEM format.

When multiple or chained CA certificates are configured the CRL is only checked for the peer’s certificate and not for the CA certificate or for an intermediate CA.

Note

CDP publishing Delta CRL are not supported.

Note

If the certificate defines multiple HTTP based distribution points in the CDP extension, only the first HTTP URI is used. All non HTTP or the other HTTP URIs are ignored.

The CRL file should be stored in PEM or DER format.

Note

This option is ignored if ssl_certificate_authority is not enabled.

4.3.8. ssl_certificate_revocation_list_refresh

Optional:

Yes
Default value:

0
Values:
  • Number of seconds
  • 0 to read at startup and after expiration.
From version:

2.8.0
To version:

None
Description:

When set to 0, the CRL file is initially loaded at startup and then loaded again after the Next Update field advertised in the CRL.

If the Next Publish extension is present in the CRL and this option is set to 0 the CRL will be loaded again at the date and time specified in the Next Publish extension.

If the CRL does not advertise the Next Update field you will have to configure a number of seconds after which the CRL should be reloaded, otherwise you will get a configuration error.

It can be configured with the number of seconds after which the local CRL file should be read again.

For example, a value of 86400 means the server will re-read the CRL after one day.

For more details about the CRL reloading see the documentation for CRL reloading rules

Note

This option is ignored if ssl_certificate_authority is not enabled.

4.3.9. ssl_cipher_list

Optional:

Yes
Default value:

ALL:!RC4:!DES:!MD5:!EXP
Values:
  • List of SSL/TLS ciphers accepted by the service.
From version:

1.7.4
To version:

None
Description:

The format for this value is the same as the one used for defining the OpenSSL cipher list. More information can be found at the following URL: http://www.openssl.org/docs/apps/ciphers.html#CIPHER_LIST_FORMAT

4.3.10. ssl_allowed_methods

Optional:

Yes
Default value:

tlsv1 tlsv1.1 tlsv1.2
Values:
  • list of SSL and TLS methods that will be accepted by this service.
From version:

1.7.4
To version:

None
Description:

Currently, the following methods are officially supported:

  • tlsv1 or tlsv1.0, which is TLS 1.0.
  • tlsv1.1, which is TLS 1.1.
  • tlsv1.2, which is TLS 1.2.

SSLv3 is still supported but highly discouraged, due to the SSLv3 POODLE vulnerability. In the case that you need to interact with an old SSL implementation that only supports SSLv3, it is highly recommended to force the usage of the non-CBC cipher RC4-SHA by configuring ssl_cipher_list: RC4-SHA.

Support for SSLv3 will be removed in future versions.

SSLv2 is no longer supported since it is not secure.

In version 2.8.0, the following new methods were added:

tlsv1.0 (alias for tlsv1), tlsv1.1 and tlsv1.2

4.3.11. idle_connection_timeout

Optional:

Yes
Default value:

300
Values:
  • Number of seconds after which idle connections are disconnected.
  • 0 - To disable timeouts.
  • Disabled - To disable timeouts.
From version:

1.7.19
To version:

None
Description:

The service will close the connection if a client connection is idle for a configurable amount of time.

4.3.12. maximum_concurrent_connections

Optional:

Yes
Default value:

10000
Values:
  • Number of maximum concurrent connections accepted by the service.
  • 0 - To disable the limit.
  • Disabled - To disable the limit.
From version:

1.7.19
To version:

None
Description:

Maximum number of allowed concurrent connections for this service.

This limit is imposed by each service, and it is not a global limit for all services active on the server.

Note

When clients use a web browser, a single session might generate multiple connections (e.g. one for getting the HTML page, one for its images, another one for its CSS files, etc.) This is why maximum_concurrent_connections is not always equal to the maximum number of concurrent users/sessions/clients.

Supported on Windows, Linux, Mac OS X, AIX, Solaris, HP-UX Unix, Virtualization and Containers, and many more ...

© Pro:Atria Ltd. All rights reserved. View our Terms & Conditions and our Privacy Statement