Introduction

Welcome to /n software SFTP Server, an easy-to-use, reliable file transfer solution featuring the SSH File Transfer Protocol. SFTP Server enables authorized users to establish a secure connection and open, read, or write files on demand.

The server is designed to be simple to configure while providing high throughput and robust security, with support for all modern algorithms such as AES (CTR, CBC, and GCM), 3DES, Blowfish, SHA-256, ECDH, and more. The novel SFTP Server is built on the rock-solid core of IPWorks SSH, and features a simple interface that can be set up in minutes.

Features

• Support for Public Key, Password, and GSSAPI Authentication (NTLM) for secure connections.
• Run as a Windows Service or as a standalone user application.
• Session management for viewing and disconnecting clients.
• Strong AES encryption, message integrity checking, secure secret key exchange.
• User-specific root directories via the '$user' reserved value.
• Unlimited concurrent remote connections (dependent on licensing).

Additional Information

You will always find the latest information about SFTP Server at our web site: www.nsoftware.com. We offer free, fully-functional 30-day trials for all of our products, and our technical support staff are happy to answer any questions you may have during your evaluation.

Please direct all technical questions to support@nsoftware.com. To help support technicians assist you as quickly as possible, please provide an detailed and accurate description of your problem, the results you expected, and the results that you received while using our product. For questions about licensing and pricing, and all other general inquiries, please contact sales@nsoftware.com.

Thank You!

Thank you for choosing SFTP Server. We realize that you have a choice among tools, and that by choosing us you are counting on us to be a key component in your business. We work around the clock to provide you with ongoing enhancements, support, and innovative products; and we will always do our best to exceed your expectations!

Running SFTP Server

Getting Started

SFTP Server can be started directly from the application's main window, via command line, or configured to run as a Windows service. Use the Start, Restart and Stop buttons in the toolbar manage the status of the listener from the main window.

End-users and clients can access SFTP Server if they are added to the users list and are enabled in the Users tab. Once the desired options and users have been configured, press the Save Changes button in the toolbar to save the changes.

Starting as a Windows Service

The application may also be configured to run as a Windows service. To enable running as a Windows service navigate to the Service tab and check the Run as a Windows Service checkbox. Click Save Changes to save the changes.

After Save Changes is pressed, no user interaction is required to start the application. The Windows service will be configured with a startup type of automatic. The user interface does not need to remain open when running as a Windows service.

Command Line Parameters

The Windows Service may be started and stopped from the command line by specifying the "servicestart" and "servicestop" command line parameters. For instance:

• To start the service: SFTPServer.exe /servicestart
• To stop the service: SFTPServer.exe /servicestop

When not running as a Windows Service the "start", "stop", "restart", and "exit" command line parameters may be used.

• To start SFTP Server: SFTPServer.exe /start
• To stop SFTP Server: SFTPServer.exe /stop
• To restart SFTP Server: SFTPServer.exe /restart
• To close SFTP Server: SFTPServer.exe /exit

Additional command line parameters:

• To retrieve the maximum number of connections: SFTPServer.exe /GetMaxConnections

Security

General Security Notes

SFTP Server allows a high degree of flexibility and control over the enabled key exchange, encryption, and MAC algorithms though Registry Keys. SFTP Server does not store passwords for virtual users in plaintext. All passwords are encrypted by DPAPI and stored in the regsitry.

Available Authentication Modes

The enabled authentication options for a user control the different ways the server will be able to authorize that user. SFTP Server supports the following authentication mechanisms: Username/Password, Public Key Authentication, Multi-factor Authentication, and GSSAPI Authentication (NTLM/Kerberos).

Password Authentication

Clients connecting to the server need to provide a username and password combination. The credentials are then verified according to the type of user.

If the client is connecting with a username of a local Windows account, the server will verify the credentials using Windows Authentication mechanisms to make sure they match a valid local account on the server or on a domain trusted by it. In addition, the server will verify the user is a member of an enabled group in the Users List before allowing access.

If the client is connecting with a username of a virtual user, the server will decrypt the user's password in the registry and compare the provided password against it.

Public Key Authentication

If Public Key Authentication is enabled, connections to the server can also authenticate using the standard public key authentication mechanism supported by the SSH protocol instead of presenting a password. Possession of a private key serves as authentication.

Multi-factor Authentication

If Multi-factor authentication is enabled, connections to the server must authenticate by using a multi-method authentication sequence combining Password authentication and Public Key authentication.

The server will return partial success if the authentication request was successful and will only authorize a user after both stages of authentication are completed successfully.

GSSAPI Authentication (NTLM/Kerberos)

NTLM or Kerberos authentication can be enabled through the server user interface by enabling GSSAPI Authentication.

Note: When using Kerberos as an authentication mechanism, it is recommended that SFTP Server be run as a service. When not running as a service and instead running under a user account, the default SPN (Service Principal Name) format of host/machine@domain used may result in errors.

In that case, a new SPN should be registered (for instance ssh/machine) with the domain controller, and the KerberosSPN registry setting for SFTP Server must be set. Additionally any connecting SFTP client will need to be configured to use the newly defined SPN.

Automatic Blocking

If a client fails authentication a specified number of times, the server will automatically block that client for a period of time beofore allowing them to attempt to connect again.

Server Configuration

The tabs in the SFTP Server UI allow basic configuration of the server.

Please be aware that configuration changes will not take effect until the Save Changes button is clicked in the SFTP Server toolbar, which will save the settings to the Windows registry.

Service

The Service tab controls whether or not the server is run as a Windows service and also provides status output. Below are the available options for this tab:

• Run as a Windows Service: If checked, the server will run as a Windows Service.
• Status: This will show information about connecting clients. To configure the verbosity of the logs set the Log Mode on the Other tab.

Sessions

The Sessions tab provides a way to manage current connections. Session management allows viewing of connected users and the ability to disconnect them if needed. Check the box Enable Session Management to get started.

The Sessions tab also contains a list of currently connected clients. This list consists of the connected client's IP Address, logged in Username, and the amount of time they have been connected. Select a user from the list and click Disconnect to remove the session.

Admin Service Notes

When running the server as a Windows service and session management is enabled, a special SSH administration service is hosted on port 8122 (default). This is exposed as a way for the user application (UI running in the system tray) to communicate with the SSH process accepting connections. The use of this service is transparent to you as the user. You do not need to take any special steps to use this, it is handled by the application.

Server Settings

The Server Settings tab provides general SFTP server settings, as well as a way to select and generate the server certificate.

Here an X.509 certificate can be selected to provide the identity of the server and support SSH connections. Certificates stored in the Windows User/Machine certificate stores as well as certificates stored in .PFX, .PEM, or .PPK files can be used.

By default a test certificate is already configured. Before moving to production it is strongly recommended that the default test certificate is changed.

Authentication

All authentication options are controlled in the Userstab. This tab manages the users and groups which can authenticate to the server. SFTP Server allows two types of users to authenticate:

• Virtual Users: A user defined in the application.
• Windows Users: All members of a specified security group on the local machine or domain.

The Users List contains the users and groups the server knows about. The authorization status and authentication options for the users and groups can be managed using the buttons on the right panel.

New users and groups can be added from this page by clicking the New User... or New Group... buttons.

To prevent a user or group from authenticating, select the entry in the users list and click the Disable button or right-click the entry in the users list and click Disable in the context menu.

Virtual Users

Double click an entry on the users list or select an entry and click Edit... to bring up the Edit page with corresponding authentication options.

Supported Authentication Methods

• Password
• Public Key
• Allow Any (Password or Public Key)
• Multi-factor (Password + Public Key)
• Windows

Below are the available options for this page:

• User: Contains the user name for the client.
• Display Name: Contains the name shown on the Users tab.
• Access: Controls the limitations on the user capabilities, such as viewing only.
• Password: Contains the password used to authorize the user when connecting via password authentication. If left empty, Password authentication will be disabled for the user.
• Public Key: Contains a list of authorized public keys for this user. During public key authentication, the server will validate the signature presented by the client against the keys stored in this field. If left empty, Public Key authentication will be disabled for the user.

  The keys should be in SSH public key format according to RFC 4253. For example:

  ssh-rsa AAAAB3NzaC1yc2EA...rPFBe7Pnc= rsa-key-20110822

Windows Users

Double click an entry on the users list or select an entry and click Edit... to bring up the Edit page with corresponding authentication options.

Below are the available options for this page:

• Security Group: This is the name of a Windows group used for authorizing access to the server. Only users who are members of this group will be allowed access. This can be a group in the local machine or a group on the domain.
• Enable Password Authentication: This specifies whether or not Password authentication is allowed. This is enabled by default.

  Note that when using Password Authentication, the recommended format for user authentication is "DOMAIN\Username".

• Enable GSSAPI Authentication: This allows GSSAPI authentication for connecting clients. This is enabled by default in licensed versions.
  • Supported Mechanisms: Specifies the authentication mechanism used. Possible values are All, Kerberos, NTLM. The default value is NTLM.
  Note that when using Kerberos as an authentication mechanism, it is recommended that SFTP Server be run as a service. When not running as a service and instead running under a user account, the default SPN (Service Principal Name) format of host/machine@domain used may result in errors. In that case, a new SPN should be registered (for instance ssh/machine) with the domain controller, and the KerberosSPN registry setting for SFTP Server must be set. Additionally any connecting SSH client will need to be configured to use the newly defined SPN.
• Windows Store Based Public Key Authentication: Controls whether Windows-based public key authentication is turned on. When selected, the server will look into the specified certificate store for a certificate with a public key matching the private key presented by the client connection. If one is found, the connection will be allowed; otherwise it will be denied.
  • Store Type: Tells the server to look for client certificates in the Machine or User stores.
  • Store Name: Tells the server to look for client certificates under the selected store.

  Note: The server has no way to match the public keys stored in the certificate store with actual Windows local/domain users. Make sure that the selected certificate store does not contain certificates for people that should not be allowed access to the server.

Other

Other

• Write Log to a File: If checked, the server will write all trace information to the file specified in the File box.
• Log Mode: Specifies how much information to log to the status window about the server execution.
• Rotate Log File Every X Days: If enabled, the log file will be rotated after the specified number of days. When a log is rotated the old log will be renamed to the format "logname-yyyy-MM-dd".
• Delete Log Files Older Than X Days: If enabled, log files older than the specified number of days will be deleted. This is only applicable to log files archived when "Rotate log file every X days" is enabled.
• Use IPV6: Controls whether IPv4 or IPv6 is used when listening. Connecting clients will need to connect using the appropriate IP version.
• Wire Encoding: Controls the encoding used by the server on the wire for text sent and received by the server. By default, the server will use ISO-8859-1 (Latin-1) encoding.

Encryption

Encryption Settings

The Encryption tab provides an optional way to encrypt files at rest. When the Enable Encryption at Rest checkbox is checked, the files on the server will remain encrypted on disk and will be transparently encrypted and decrypted as necessary. Users who authenticate to SFTP Server and download a file will obtain decrypted data but all file data will remain encrypted on the server.

Enabling Encryption

To enable encryption at rest, specify and confirm the encryption password. The password itself is encrypted by the system and saved in the registry (see Registry Keys for details).

The first time encryption is enabled and Save Changes is pressed, all files present in the server root directory, a user-specific root directory, or a sub-directory therein will be encrypted. Depending on the number and size of files this may take some time.

After the initial encryption completes, it is expected that files will only be added to the server's filesystem using the SFTP protocol. Plain files created directly on disk alongside encrypted files will not automatically be encrypted and will not be available to users.

Changing The Password

To change the password, visit the Encryption tab and use the Change ... button to change the password. When Save Changes is pressed, the operation will begin. This operation is faster than encrypting or decrypting files, but still may take some time depending on the number of files present.

Disabling Encryption

To disable encryption at rest, uncheck the Enable Encryption At Rest checkbox on the Encryption tab. When Save Changes is pressed the encrypted files will be decrypted. Depending on the number and size of files this may take some time.

Encryption Format Notes

Files are encrypted using standard disk encryption techniques leveraging the XTS-AES 256-bit block cipher algorithm. The encrypted files on disk will have an .aesd file extension. This file format is the same format as used by AES Drive. Please see The AES Drive documentation for details.

Registry Keys

Configuration options for SFTP Server are stored in the Windows registry in HKEY_LOCAL_MACHINE\SOFTWARE\nsoftware\SFTPServer\22. This registry key holds settings that are available for SFTP Server globally. Additional registry keys are available to store authorized keys or user-specific configuration.

The tree structure of these registry keys is described below:

• HKEY_LOCAL_MACHINE\SOFTWARE\nsoftware\SFTPServer\22
  • Authorized Keys
  • Users

The following values can be configured within the root HKEY_LOCAL_MACHINE\SOFTWARE\nsoftware\SFTPServer\22 registry key:

Authorized Keys

SFTP Server may be configured to authorize users against known public keys. When a client performs public key authentication, it presents a signature created with the private key. The server will try to verify the signature is valid using each of the known public keys until it finds a match.

To add an approved public key, you may either specify it directly in the New User... form or add it to the registry. Possession of a private key which corresponds to an allowed public key serves as authentication.

Known public keys can be added to the Windows Registry at the following location. If the key does not exist go ahead and create it.

HKEY_LOCAL_MACHINE\SOFTWARE\nsoftware\SFTPServer\22\AuthorizedKeys

Create a new String value and set the value data to the public key in SSH public key format as specified by RFC 4253 (also known as OpenSSH public key format). Briefly, an OpenSSH public key consists of three parts all on a single line:

• The key type
• A chunk of PEM-encoded data
• A comment

Example:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQ...w== rsa-key-20191008

The name of the String value is not used, but it is recommended to set this to the name of the user that the public key corresponds to for organizational purposes.

Users

The following values can be configured independently for each user, at HKEY_LOCAL_MACHINE\SOFTWARE\nsoftware\SFTPServer\22\Users: