SFTPServer Component
Properties Methods Events Configuration Settings Errors
The SFTPServer component is used to create a SFTP Server.
Syntax
TipfSFTPServer
Remarks
The SFTPServer component provides a simple way to create a SFTP server. Any SFTP client will be able to connect and transfer files to and from the server.
Getting Started
To begin, first provide a valid certificate with private key in the SSHCert property.
Optionally set the RootDirectory property to a valid local path. If this property is set the component will serve files from this location and when clients connect they will see this as their initial directory. If this property is not set then the component will fire events allowing customized responses for each operation.
To start the server set Listening to true.
Client Authentication
Client authentication is handled through the SSHUserAuthRequest event. Inside this event, the Accept parameter determines whether authentication is accepted; this parameter should be set to True if a successful authentication is detected and False otherwise.
When a client connects, the AuthMethod parameter indicates the method of authentication the client wishes to use. Connecting clients will initially attempt authentication with an AuthMethod of "none". This is done with the expectation that the request will fail and the server will provide a list of support authentication methods. The client then selects an available method and re-authenticates. If AuthMethod is "none", Accept should be set to False.
For password authentication, the User parameter will hold the client's username and the AuthParam parameter will hold the password provided by the client. An external list of known usernames and passwords should be maintained to check these values against.
For publickey authentication, the User parameter will hold the client's username and the AuthParam parameter will hold the key provided by the client. This key should be compared to and external list of known keys and usernames.
For keyboard-interactive authentication, the SSHUserAuthRequest event will fire multiple times; once for each prompt and response sent by the client. The index of the response is specified as a suffix in the AuthMethod parameter (e.g. keyboard-interactive-1, keyboard-interactive-2, etc), and AuthParam will contain the client's response to the prompt. Finally, SSHUserAuthRequest will fire one last time with AuthMethod set to "keyboard-interactive" and AuthParam set to an empty string. The Accept parameter must be set to True each time the event fires in order for the authentication process to succeed.
Directory Listing
When a client requests a directory listing, the DirList event fires with the Path parameter set to the directory to enumerate. If the directory listing is allowed, the appropriate set of files should be passed to the SetFileList method. The StatusCode parameter should be set according to the status of the operation, and the valid status codes can be found in the documentation for the DirList event.
Handling Events
Event handlers are the primary method of customizing the component's functionality. When a client attempts to connect, open a file, authenticate to the server, etc, the corresponding SFTPServer event will fire to allow for custom handling of the client's request.
The following events are fired both before and after the requested operation is executed:
Each of these events has a BeforeExec event parameter that is True when the event is fired before execution of the operation, and False after execution of the operation. Handling the event before execution provides an opportunity to use custom logic to determine whether the operation should be denied, diverted, or otherwise modified. Handling the event after execution provides an opportunity to report success or any errors related to the operation to the client.
The following events are fired only after the requested operation is executed:
Any logic to deny opening a file for read or write should be done in the FileOpen event handler.
Note: Server components are designed to process events as they occur. To ensure events are processed in a timely manner DoEvents should be called in a loop after the server is started.
Property List
The following is the full list of the properties of the component with short descriptions. Click on the links for further details.
ConnectionBacklog | The maximum number of pending connections maintained by the TCP/IP subsystem. |
SFTPConnectionCount | The number of records in the SFTPConnection arrays. |
SFTPConnectionConnected | Used to disconnect individual connections and/or show their status. |
SFTPConnectionErrorMessage | ErrorMessage is used together with status codes returned from events to send informative errors back to the SFTP client through the SSH_FXP_STATUS message. |
SFTPConnectionFileData | The FileData should be set or read when processing read/write file events. |
SFTPConnectionLocalAddress | This property shows the IP address of the interface through which the connection is passing. |
SFTPConnectionProtocolVersion | The ProtocolVersion shows the SFTP protocol version negotiated with the client when the SFTP connection was established. |
SFTPConnectionRemoteHost | The RemoteHost shows the IP address of the remote host through which the connection is coming. |
SFTPConnectionRemotePort | The RemotePort shows the TCP port on the remote host through which the connection is coming. |
SFTPConnectionTimeout | A timeout for the component. |
DefaultAuthMethods | Specifies the supported authentication methods. |
DefaultTimeout | An initial timeout value to be used by incoming connections. |
KeyboardInteractiveMessage | The instructions to send to the client during keyboard-interactive authentication. |
KeyboardInteractivePromptCount | The number of records in the KeyboardInteractivePrompt arrays. |
KeyboardInteractivePromptEcho | Specifies if the client should echo the value entered by the user or not. |
KeyboardInteractivePromptPrompt | The prompt label/text the client should present to the user. |
Listening | If True, the component accepts incoming connections on LocalPort. |
LocalHost | The name of the local host or user-assigned IP interface through which connections are initiated or accepted. |
LocalPort | The TCP port in the local host where the component listens. |
RootDirectory | The root directory for the entire SFTP server. |
SSHCertEncoded | The certificate (PEM/base64 encoded). |
SSHCertStore | The name of the certificate store for the client certificate. |
SSHCertStorePassword | If the certificate store is of a type that requires a password, this property is used to specify that password in order to open the certificate store. |
SSHCertStoreType | The type of certificate store for this certificate. |
SSHCertSubject | The subject of the certificate used for client authentication. |
SSHCompressionAlgorithms | A comma-separated list containing all allowable compression algorithms. |
SSHEncryptionAlgorithms | A comma-separated list containing all allowable encryption algorithms. |
Method List
The following is the full list of the methods of the component with short descriptions. Click on the links for further details.
Config | Sets or retrieves a configuration setting. |
Disconnect | Disconnect the specified client. |
DoEvents | Processes events from the internal message queue. |
ExchangeKeys | Causes the component to exchange a new set of session keys on the specified connection. |
Reset | Reset the component. |
SetFileList | Sets the file list for a connection during a directory listing request. |
Shutdown | Shuts down the server. |
Event List
The following is the full list of the events fired by the component with short descriptions. Click on the links for further details.
Connected | Fired immediately after a connection completes (or fails). |
ConnectionRequest | Fired when a request for connection comes from a remote host. |
DirCreate | Fires when a client wants to create a new directory. |
DirList | Fires when a client attempts to open a directory for listing. |
DirRemove | Fires when a client wants to delete a directory. |
Disconnected | Fired when a connection is closed. |
Error | Information about errors during data delivery. |
FileClose | Fires when a client attempts to close an open file or directory handle. |
FileOpen | Fires when a client wants to open or create a file. |
FileRead | Fires when a client wants to read from an open file. |
FileRemove | Fires when a client wants to delete a file. |
FileRename | Fires when a client wants to rename a file. |
FileWrite | Fires when a client wants to write to an open file. |
GetAttributes | Fires when a client needs to get file information. |
Log | Fires once for each log message. |
ResolvePath | Fires when a client attempts to canonicalize a path. |
SetAttributes | Fires when a client attempts to set file or directory attributes. |
SSHStatus | Shows the progress of the secure connection. |
SSHUserAuthRequest | Fires when a client attempts to authenticate a connection. |
Configuration Settings
The following is a list of configuration settings for the component with short descriptions. Click on the links for further details.
DirListBufferSize[ConnectionId] | The number of entries to be returned in one response to a request for a directory listing. |
MaskSensitive | Masks passwords in logs. |
ProtocolVersion | The highest allowable SFTP version to use. |
RestrictUserToHomeDir[ConnectionId] | Whether to restrict the user to their home directory. |
ServerEOL | Specifies the line endings used in files on the server. |
SFTPErrorMessage[ConnectionId] | Specifies the error message to be returned to the client. |
UserRootDirectory[ConnectionId] | The path of the server root directory for a particular user. |
AltSSHCertCount | The number of records in the AltSSHCert configuration settings. |
AltSSHCertStore[i] | The name of the certificate store. |
AltSSHCertStorePassword[i] | The password used to open the certificate store. |
AltSSHCertStoreType[i] | The type of certificate store. |
AltSSHCertSubject[i] | The alternative certificate subject. |
DefaultIdleTimeout | Specifies the default idle timeout for inactive clients. |
KeyboardInteractivePrompts[ConnectionId] | Specifies custom keyboard-interactive prompts for particular connections. |
KeyRenegotiationThreshold | Sets the threshold for the SSH Key Renegotiation. |
LogLevel | Specifies the level of detail that is logged. |
MaxAuthAttempts | The maximum authentication attempts allowed before forcing a disconnect. |
ServerSSHVersionString | The SSH version string sent to connecting clients. |
SSHKeepAliveCountMax | The maximum number of keep alive packets to send without a response. |
SSHKeepAliveInterval | The interval between keep alive packets. |
SSHKeyExchangeAlgorithms | Specifies the supported key exchange algorithms. |
SSHMacAlgorithms | Specifies the supported Mac algorithms. |
SSHPubKeyAuthSigAlgorithms | Specifies the allowed signature algorithms used by a client performing public key authentication. |
SSHPublicKeyAlgorithms | Specifies the supported public key algorithms. |
SSHVersionPattern | The pattern used to match the remote host's version string. |
UserAuthBanner[ConnectionId] | A custom user authentication banner. |
AllowedClients | A comma-separated list of host names or IP addresses that can access the component. |
BindExclusively | Whether or not the component considers a local port reserved for exclusive use. |
DefaultConnectionTimeout | The inactivity timeout applied to the SSL handshake. |
InBufferSize | The size in bytes of the incoming queue of the socket. |
KeepAliveInterval | The retry interval, in milliseconds, to be used when a TCP keep-alive packet is sent and no response is received. |
KeepAliveTime | The inactivity time in milliseconds before a TCP keep-alive packet is sent. |
MaxConnections | The maximum number of connections available. |
OutBufferSize | The size in bytes of the outgoing queue of the socket. |
TcpNoDelay | Whether or not to delay when sending packets. |
UseIPv6 | Whether to use IPv6. |
BuildInfo | Information about the product's build. |
CodePage | The system code page used for Unicode to Multibyte translations. |
LicenseInfo | Information about the current license. |
UseInternalSecurityAPI | Tells the component whether or not to use the system security libraries or an internal implementation. |