SFTP & SCP

SFTP Server Capabilities ​

As an SFTP server, SFTPPlus enables other SFTP clients to connect and exchange files securely. This functionality is a cornerstone of the platform, providing a reliable and secure endpoint for partners, customers, or internal systems to upload and download data. The server-side implementation leverages the SSH secure communication protocol to protect all transfers. This ensures data confidentiality and integrity through encryption and authentication.

SFTPPlus also supports the older SCP (Secure Copy Protocol) for server-side transfers. SCP is a file transfer protocol that also operates over SSH. While SFTP is generally more feature-rich and is the modern standard, SCP support ensures compatibility with legacy systems that may not have SFTP capabilities.

Reduce service fingerprinting ​

SFTPPlus does not advertise its product version during the SSH protocol handshake. This reduces the implementation details exposed to unauthenticated clients and makes it harder to target a service based only on its reported software version.

The generic protocol identity also supports white-labelled SFTP endpoints that use an organization's own service name in customer documentation.

Connection Banners and Compliance Notices ​

Before asking for user credentials, the SFTPPlus SFTP server can send a standard SSH banner to compatible clients. The banner can display a message of the day, an authorized-use warning, a legal disclosure, maintenance information, or other instructions required by an organization's security policy.

Administrators configure the multi-line message with the before_login_message option on the SSH service. Because the client receives the banner before authentication, users see the notice before they attempt to sign in.

SFTP Client Capabilities ​

In its role as an SFTP client, SFTPPlus can connect to remote SFTP servers. This is particularly useful for automating file transfers. The solution can be configured to automatically upload files to a remote server or to download files from a remote server at scheduled intervals or in response to events. This automation capability is critical for business processes that rely on the timely exchange of data with third parties.

An SFTP client location can authenticate with a password, a private SSH key, or both methods in the same connection. Combined authentication supports remote servers that require both the password and the SSH key before granting access.

Connect through a SOCKS5 proxy ​

An SFTP or SCP client location can connect to its remote server through a SOCKS5 proxy. SFTPPlus supports SOCKS5 proxies without authentication and delegates DNS resolution for the remote server to the proxy. When the proxy URI does not include a port, SFTPPlus uses port 1080.

The proxy is configured separately for each SFTP location, allowing different partner connections to use different network routes.

SSH Security and Protocol Foundation ​

All SFTP and SCP transfers within SFTPPlus are protected by the SSH (Secure Shell) protocol. SSH provides a secure communication channel, safeguarding data against eavesdropping and manipulation. The security features of SSH, including host key verification and user authentication, are fundamental to the secure file transfer capabilities of SFTPPlus MFT.

The SSH algorithm suite can be customized for both SFTP services and client locations. The default secure suite is a curated list of the host key, encryption, message authentication, and key exchange algorithms currently considered secure. Upgrading SFTPPlus applies changes made to this list when an algorithm is deprecated. Administrators can instead define an explicit suite to meet a stricter security policy, introduce newly approved algorithms, or maintain compatibility with a legacy system.

SSH authentication ​

Alongside public-key authentication for individual accounts, SFTPPlus SFTP and SCP servers support SSH hostbased authentication as defined in RFC 4252. This method uses the client host's SSH key and identity as part of authenticating a user.

The hostbased method is disabled by default for security reasons. Administrators can enable it for selected groups with the ssh_hostbased_auth group configuration option when host-based trust is required.

When SSH key authentication fails, the audit log message includes the SHA256 fingerprint of the key presented by the remote client. An administrator can compare this fingerprint with the expected public key to identify which key the client actually used, without logging the full public key.

SFTPPlus can act as a bridge to move files between different systems.

File Transfer Bridging ​

SFTPPlus client transfers can be used as a bridge to move files from a variety of sources to and from an SFTP server. This allows for the integration of different file transfer protocols and storage systems. For example, SFTPPlus can be configured to download files from a standard FTP server and then upload them to an SFTP server. This bridging capability extends to other systems as well, including:

• Web Servers: Downloading files from an HTTP or HTTPS source.
• Cloud Storage: Transferring data to or from services like Azure Blob Storage.
• Collaboration Platforms: Moving files to or from platforms such as SharePoint Online.

By acting as a central hub, SFTPPlus simplifies workflows that require data to be moved securely between different environments and protocols. This eliminates the need for manual intervention or custom scripts for each transfer path, creating an automated and reliable data pipeline.

Support and consultancy from experts ​

The comprehensive SFTP support in SFTPPlus MFT provides a secure and automated solution for all your file transfer needs.

To help with the implementation of your SFTP transfers and to learn more about how SFTPPlus can integrate with your existing infrastructure, get in touch with our support team.

We are available to assist with configuration and to answer any questions you may have.