4.14. SSH (SFTP and SCP) Service

This page describes the configuration options available for the SSH service, using SFTP and SCP file transfer protocols.

Both the SFTP and the SCP protocols make use of the SSH protocol for low-level encryption of transferred data. Due to this, SFTPPlus uses a generic SSH service that provides support for both SFTP and SCP. SFTP and SCP can be independently enabled.

Multiple SSH services can share the same set of RSA and DSA host keys.

4.14.1. sftp

Optional:

Yes

Default value:

Yes

Values:

• No - To disable SFTP support.
• Yes - To enable SFTP support.

From version:

2.5.0

To version:

None

Description:

Enable/Disable support for the SFTP protocol.

4.14.2. scp

Optional:

Yes

Default value:

No

Values:

• No - To disable SCP support.
• Yes - To enable SCP support.

From version:

2.5.0

To version:

None

Description:

Enable/Disable support for the SCP protocol.

4.14.3. rsa_public_key

Optional:

Yes

Default value:

configuration/sftp-service-rsa-public.key

Values:

• Path to file containing the public RSA key file used by the service.

From version:

1.6.0

To version:

None

Description:

The public key can be stored in various formats, but it is recommended to store it in the OpenSSH public key format.

4.14.4. rsa_private_key

Optional:

Yes

Default value:

configuration/sftp-service-rsa-private.key

Values:

• Path to file containing private RSA key file used by the service.

From version:

1.6.0

To version:

None

Description:

The private key can be stored in various formats, but it is recommended to store it in the OpenSSH private key format.

4.14.5. rsa_private_key_password

Optional:

Yes

Default value:

Disabled

Values:

• Password for the RSA private key as text.

From version:

1.7.19

To version:

None

Description:

The password is used for decrypting the stored RSA private key, in the case that it is stored encrypted on disk.

4.14.6. dsa_public_key

Optional:

Yes

Default value:

configuration/sftp-service-dsa-public.key

Values:

• Path to file containing the public DSA key file used by the service.

From version:

1.6.0

To version:

None

Description:

The public key can be stored in various formats, but it is recommended to store it in the OpenSSH public key format.

4.14.7. dsa_private_key

Optional:

Yes

Default value:

configuration/sftp-service-dsa-private.key

Values:

• Path to file containing the private DSA key file used by the service.

From version:

1.6.0

To version:

None

Description:

The private key can be stored in various formats, but it is recommended to store it in the OpenSSH private key format.

4.14.8. dsa_private_key_password

Optional:

Yes

Default value:

Disabled

Values:

• Password for the DSA private key as text.

From version:

1.7.19

To version:

None

Description:

The password is used for decrypting the stored DSA private key, in the case that it is stored encrypted on disk.

4.14.9. primes

Optional:

Yes

Default value:

‘’

Values:

• Path to a file with pre-computed prime numbers.
• Leave Empty in the case that you don’t want to use the pre-computed primes database file.

From version:

1.6.0

To version:

None

Description:

The prime numbers database is used by the Diffie Hellman Group Exchange SHA1 protocol as specified by http://tools.ietf.org/html/rfc4419.

The prime numbers database is stored in a file using the OpenSSH format.

The server provides a default prime numbers database file.

4.14.10. ssh_cipher_list

Optional:

Yes

Default value:

all

Values:

• List of SSH ciphers accepted by the service.
• all.
• fips.

From version:

3.11.0

To version:

None

Description:

The full name for each cipher should be used.

This will configure the symmetrical, asymmetrical and key exchange algorithms.

The special keyword all is available for configuring all the supported algorithms. When used, all other values are ignored.

A pre-defined set of FIPS 140-2 approved ciphers is available by using the special fips keyword in this configuration. When fips ciphers are enabled, any other configured cipher in the list is ignored.

If an unsupported cipher is used the service will fail to start.

More information about the accepted values can be found at the cryptography guide

4.14.11. banner

Optional:

Yes

Default value:

SFTPPlus

Values:

• Any text message.

From version:

1.6.0

To version:

None

Description:

Message used by the service to welcome new SFTP client connections.

4.14.12. ignore_create_permissions

Optional:

Yes

Default value:

No

Values:

• No - To apply requested file permissions at file creation.
• Yes - To ignore SFTP client’s file permissions at file creation.

From version:

1.7.13

To version:

None

Description:

Some SFTP clients, like the OpenSSH SFTP client, will always preserve file and folder permissions even if -p option is not used in the client.

To work around this problem, the server can be configured to ignore client requests to set permissions when creating a file or folder.

When permissions are ignored, the default file mode (umask) is applied.

4.14.13. idle_connection_timeout

Optional:

Yes

Default value:

300

Values:

• Number of seconds after which idle connections are disconnected.
• 0 - To disable timeouts.
• Disabled - To disable timeouts.

From version:

1.7.19

To version:

None

Description:

The service will close the connection if a client connection is idle for a configurable amount of time.

4.14.14. maximum_concurrent_connections

Optional:

Yes

Default value:

10000

Values:

• Number of maximum concurrent connections accepted by the service.
• 0 - To disable the limit.
• Disabled - To disable the limit.

From version:

1.7.19

To version:

None

Description:

Maximum number of allowed concurrent connections for this service.

This limit is imposed by each service, and it is not a global limit for all services active on the server.