SFTPPlus provides a command line utility for managing the server process.
The admin-commands utility is the main tool for administering SFTPPlus from the command line.
To start the server, use the following command:
./bin/admin-commands.sh start
By default it will start using the configuration file located at configuration/server.ini and will store the process ID inside the run/server.pid file.
To stop the server, send the kill signal to the process ID stored inside the run/server.pid file.
To store the process ID in a different file, start the server using -p or --pid arguments:
./bin/admin-commands.sh start --pid=/path/to/PID_FILE
If you want to launch the server using a configuration file from a specific location, use the -c or --config= argument:
./bin/admin-commands.sh start --config=/path/to/CONFIGURATION_FILE
While testing various configuration options, SFTPPlus can be launched in testing mode, in order to provide quick feedback to internal server operations.
To launch the server in testing mode, use the following command:
./bin/admin-commands.sh debug
Note
If you want to launch the server using a configuration file from a specific location the –config=/path/to/CONFIGURATION_FILE option can be used.
Note
While running in test mode, the server will send log files to the attached console, as well as to any other logging facility, unless configured otherwise.
The admin-commands utility can generate encrypted passwords for use inside the configuration file.
Passwords can be generated in interactive or non-interactive mode.
After the command is executed, it will list the encrypted password. This can be copied inside the configuration file.
To generate a password in non-interactive mode:
./bin/admin-commands.sh generate-password NEW_PASSWORD
NEW_ENCRYPTED_PASSWORD_HERE
When generating a password in interactive mode, the command will ask for the new password and confirmation for it:
./bin/admin-commands.sh generate-password
Enter password (not echoed) :
Confirm password (not echoed):
NEW_ENCRYPTED_PASSWORD_HERE
Note
The entered password will not be printed / echoed to the standard output.
To generate an SSH key pair use the following command:
./bin/admin-commands.sh \
generate-ssh-key \
--key-type=rsa \
--key-file=KEY_FILENAME \
--key-comment=COMMENT
You can replace rsa with dsa to generate a DSA key pair.
This will generate the following files:
- KEY_FILENAME containing the private part of the key in OpenSSH format.
- KEY_FILENAME.pub containing the public part of the key in OpenSSH format.
Keys can be exchanged between SFTPPlus and an OpenSSH Server without requiring any additional conversion steps.
Before you can order an SSL Certificate from any provider, you must first generate a CSR (Certificate Signing Request) for your server.
To generate a new SSL key and an associated certificate signing request:
./bin/admin-commands.sh \
generate-csr \
--common-name=fs.domain.tld \
--key-size=2048 \
--key-file=KEY_FILENAME.key \
--alternative-name="IP:192.168.7.1,DNS:www.fs.domain.tld" \
--email="admin@domain.tld" \
--organization=ACME \
--organization-unit="ACME IT Services" \
--locality=London \
--state=England \
--country=GB
Note
On Windows, you should quote values with spaces using double quotes. Single quotes are not supported.
On Windows, the reported error messages are not displayed in Unicode, but instead as ASCII, using Unicode transliteration.
To enter Unicode characters from the Windows command prompt, you will need a font which supports Unicode (Lucida Console).
The private key is generated in RSA format. The certificate request is signed using SHA256 hash function.
This will generate the following files:
Please consult your SSL certificate provider for details about what values to use for common name, organization, and locality.
–common-name is mandatory and should be the same value as the address used by the client to access this server. Usually, it is the Fully Qualified Domain Name (FQDN) of your server.
–organization and –organization-unit are optional. Most of the time you will need to only pass the –organization option.
In the case that you don’t use alternative names to access the server, you don’t need to pass the –alternative-name option. The IP address used in the alternative name option can be in either IPv4 or IPv6 format.
Note
Unicode domain names in –common-name, –email and –alternative-name options are assumed to be using Internationalized Domain Name (IDN) and they are encoded using the Internationalizing Domain Names in Applications (IDNA) encoding, as described in RFC 6125 section 6.4.2.
Note
Unicode values in –organization, –organization-unit, –locality and –state options are encoded using UTF-8.
Warning
The –country option does not support Unicode values.
You can validate your certificate using the web-based Symantec SSL Tools.
You can check all fields of the generated certificate using a web-based decoder, such as the one provided by Cert Logic.
To generate a version 4 UUID use the following command:
./bin/admin-commands.sh generate-uuid (on Unix)
admin-commands.bat generate-uuid (on Windows)
After the command is executed, it will list the generated UUID in version 4 format on standard output. This can be copied inside the configuration file.
To validate the server configuration, use the following command:
./bin/admin-commands.sh validate (on Unix)
admin-commands.bat validate (on Windows)
After the command is executed, it will list whether the configuration is valid or not on standard output.
Note
If the configuration is not valid, the exit code is 1.