4.13.1. Introduction¶

This page describes the configuration options available for the SSH service, using SFTP and SCP file transfer protocols.

Both the SFTP and the SCP protocols make use of the SSH protocol for low-level encryption of transferred data. Due to this, SFTPPlus uses a generic SSH service that provides support for both sftp and scp services. SFTP and SCP can be independently enabled.

Multiple SSH services can share the same set of RSA and DSA host keys.

4.13.2. Configuration Options¶

Below are the configuration options available for the SFTP and SCP protocols.

4.13.3. Configuring SSH key-based authentication on the server¶

An account can have both password and SSH keys authentication methods enabled at the same time. At connection time, the SSH server and client will perform a negotiation step and the server will use only one method for authenticating the session.

Password authentication can be disabled for an account, in which case the server will force the client to use SSH keys for authentication.

An account is configured with one or many public SSH keys (a list). When the same account is used to connect from multiple machines, you will want to generate one pair of SSH keys for each machine, so that a private key never leaves the machine on which it is used.

For each account, there is an associated local file. It contains the public SSH keys, in OpenSSH public key format, accepted during the authentication.

To add a public key, you will have to copy the content of the public key from the file usually named KEY_NAME.pub and paste it on a new line into the file containing the list of allowed SSH keys.

There are two main approaches for configuring SSH keys for an account:

1. Only the server's administrators can manage the list of allowed SSH keys. In this case the file containing allowed SSH keys is stored somewhere outside the account's home folder.

2. Allow an account to have access to its own list of allowed SSH keys. Server administrators can still manage the list. The file with the list of allowed public SSH keys is stored inside the account's home folder. This is similar to OpenSSH configuration, where the list is stored in .ssh/authorized_keys file.

4.13.4. Local Manager GUI configuration¶

Configuring the list of authorized SSH keys for an Account:

Create a local file where public SSH keys associated with this account are stored. In our example, the file is located at c:\\Users\\sftp_access\\John_keys

Go to the account's configuration page and enter the path in the Allowed SSH Keys Path field.

For the above configuration, the account's home folder is in c:\\Users\\John and it has no access to manage its own SSH keys.

Configuring the list of authorized SSH keys for a Group:

Note that the path must contain the ${USER} value as a placeholder linking to the username.

In the example above, the file path included ${USER}. The text file equivalent:

[groups/bdfe8e48-5100-4d8a-bac1-441ebc04f9a7]
name = Support_Group
ssh_authorized_keys_path = /home/${USER}/.ssh/authorized_keys

In the above examples, the server will read the authorized SSH keys file located at /path_to/john/authorized_keys for a ${USER} called john.

If the path does not include the ${USER} value, it is appended at the end.

Therefore, a file path of /authorized_keys is read as /path_to/authorized_keys/john for a ${USER} called john.

4.13.5. Text file configuration¶

The ssh_authorized_keys_path option from the configuration file specifies the path to the file containing the list of allowed SSH RSA/DSA public keys for each user.

In text file configuration, the path can contain the ${USER} value:

[groups/DEFAULT_GROUP]
ssh_authorized_keys_path = /home/${USER}/.ssh/authorized_keys

When john is authenticated, the server will seek out the authorized SSH keys file /home/john/.ssh/authorized_keys/.

To disable SSH key-based authentication leave this value empty, as in the example below:

[groups/DEFAULT_GROUP]
ssh_authorized_keys_path =

4.13.6. Configuration options¶