JSCAPE MFT Server User's Guide
Reklāma
Reklāma
User's Guide
JSCAPE MFT Server
Copyright JSCAPE 1999-2014
Contents
2
3 Evaluation license limitations
46 Auto-starting in Linux and Solaris 9 environments
47 Auto-starting in Solaris 10 environments
47 Running as non-root user in UNIX environments
49 Additional libraries needed for OpenPGP
50 Additional libraries needed for SFTP ciphers
51 Starting the JSCAPE MFT Server Service
52 Launching the JSCAPE MFT Server Manager
Contents
60 Setting SFTP/SSH authentication mode
62 Using public key authentication in SFTP/SSH
65 Setting logging preferences
72 Storing account details in a database
79 Assigning domain administrators
81 Setting authentication preferences
94 Authenticating with Microsoft Active Directory
96 Authenticating using custom authentication API
98 Adding anonymous user accounts
110 Setting connection preferences
118 Backing up server configuration files
119 Defining a failover server
122 Defining password compliance
125 Monitoring server resources using JMX
3
4
Contents
126 Performing backups of server configuration data
127 AS2 (Applicability Statement 2)
142 Manually executing time based triggers
145 Defining custom action types
146 File Transfer Script Language
159 Enabling web based file transfers
165 Customizing the web interface
168 Performing automatic login
Contents
169 Adding custom forms on file upload
173 Enabling web document viewer
181 Searching and tagging documents
188 Creating a directory monitor
190 Accelerated file transfer (AFTP)
192 Connecting to AFTP service
192 Data loss prevention (DLP)
197 Stopping and starting a domain
5
6
Contents
Contents
216 Mapping a reverse proxy to a virtual path
Obtaining a trusted certificate
Importing third party certificates
7
8
Contents
Exporting a certificate, public or private key
Importing a certificate and/or public key
Exporting a certificate and/or public key
Exporting public and private keys
Encrypting files and virtual paths
JSCAPE MFT Server Manager Settings
Introduction 1
Overview
JSCAPE MFT Server is a platform independent managed file transfer server that supports FTP, FTPS (FTP over SSL), SFTP (FTP over SSH), HTTP, HTTPS. AFTP and WebDAV protocols. Features of JSCAPE
MFT Server include:
Feature
Platform Independent
Multiple Protocol Support
Integrated Web File Transfer Client
Accelerated File Transfer
Web Document Viewer
Data Protection
Data Loss Prevention
Ad-hoc File Transfers
Benefit
Support for Windows, Linux, Solaris, AIX, Linux Z/
OS and Mac OS X environments provides the flexibility of deploying anywhere within your organization.
Support for AS2, FTP, FTPS (FTP over SSL),
SFTP, SCP (Secure Copy), AFTP (Accelerated
File Transfer Protocol), HTTP, HTTPS and
WebDAV protocols means you can easily exchange data with your customers, regardless of their file transfer requirements.
Licensing and support costs are significantly reduced as there is no client software to install.
Your clients need only a web browser in order to start transferring files. In addition, when using the integrated web client, users do not have to worry about strict internal firewall policies as most organizations do not restrict web based traffic.
AFTP (Accelerated File Transfer Protocol) is a file transfer protocol developed by JSCAPE. AFTP is designed to accelerate file transfers over high speed networks that are unable to fully utilize network throughput due to high latency and packet loss. Under these conditions AFTP can accelerate file transfers up to 100 times faster than FTP and other file transfer protocols.
JSCAPE Web Document Viewer simplifies content distribution by embedding a document viewer in the
JSCAPE MFT Server web interface. With support for numerous document formats, users can view documents on the server without having to download or have supporting software installed.
Your sensitive data is protected during transit and at rest using high-grade OpenPGP and SSL encryption technologies. This is critical for many companies who are now subject to PCI-DSS,
HIPAA and Sarbanes-Oxley data protection requirements.
Prevent the loss of sensitive data using an embedded DLP rules engine.
Perform email based file transfers while avoiding the issues commonly experienced with large email attachments.
Chapter 1 Introduction 1
Introduction
Triggers
Authentication Integration
Action API
REST API
Checkpoint and Restart Support
Integrity Checksum
Email Notifications
OpenPGP Encryption
2 Chapter 1 Introduction
1
Using triggers you can quickly automate business processes based on events and conditions. For example, whenever a file is received by a customer you may wish to automatically compress that file and then forward it via email to the corresponding account representative for further processing.
Authenticate users against existing LDAP, NTLM,
Active Directory, PAM or relational database servers. This greatly simplifies the integration process, especially in organizations with a large number of users.
Using triggers you can define one or more actions to be executed in response to matching events and event conditions. More than 80 built-in actions allow you to do everything from compress files,
OpenPGP encrypt files, send emails and more.
While this may be enough for most organizations, the Action API is a Java based API that allows you to define your own actions should you have more specialized needs. For example, let's say that you need to parse a PDF document upon upload and communicate the parsed data to another server via
JMS. This can be easily accomplished using the
Action API.
REST API are available for both client and administrative users. Using the REST API users can do everything from performing file transfers to managing the server.
Large file transfers over the Internet are subject to occasional failure due to network related issues. In the event of a failed file transfer, checkpoint and restart support allows you to restart the transfer from the last byte of data successfully transferred versus re-transferring the entire file. This is critical in organizations that transfer very large files or have service level agreements with customers to transfer a file within a given time period.
Checksum verification is a post file transfer process that verifies the integrity of files transferred. This is accomplished by comparing checksums of the file on both the sender and receiver sides ensuring that files are transferred correctly.
Receive email notifications on the events that are important to you. For example, as a system administrator you may wish to be notified via email if a users account is disabled due to a successive number of invalid login attempts.
Use OpenPGP encryption to ensure that your data is encrypted while at rest or to automatically
Introduction
Automated File Transfers
Database Logging
Reverse Proxies
IP Access Rules
Virtual File System
Multiple Domains
Remote Administration
Server and Account Management API
1 decrypt files sent to you by your customers who use OpenPGP encryption.
Automatically transfer files to/from the server using
FTP/FTPS/SFTP/SCP protocols. This is perfect for use in situations where you must transfer files on a scheduled basis or based on other event conditions.
Using the database logging features you can ensure that all server activity is safely stored in a remote database.
Map remote FTP/FTPS/SFTP/WebDAV services to virtual directories on your server. This allows you to grant users access to remote services using a single sign-on account. Users no longer have to remember multiple hostnames, usernames and passwords. This feature is also very useful streaming data between a public server located in the DMZ and a private server located behind your firewall.
Lock down your server using access rules based on client IP address.
Define a virtual file system, users and permissions without having to create users or permissions at the operating system level.
Create multiple virtual servers each with it's own set of users and permissions.
Securely manage your server remotely from anywhere in the world.
Java based API for integrating account and server management functions within external applications.
System requirements
Oracle/Sun or IBM JVM (Java Virtual Machine) 1.6 or above.
Windows XP/2003/Vista/2008/7/2012, Mac OS 10.x, Solaris, Linux, Linux Z/OS and AIX 5.x/6.x/7.x
platforms.
Current and previous (Current -1) versions of IE, Firefox, Safari and Chrome browsers.
Evaluation license limitations
The Evaluation Edition of JSCAPE MFT Server is fully functional offering all features found in the Enterprise
Edition yet is limited to 3 users/connections and 1 domain.
Chapter 1 Introduction 3
Introduction 1
To purchase the Professional or Enterprise Edition of JSCAPE MFT Server please go to http:// www.jscape.com/secureftpserver/purchase.html
to purchase a license or submit a ticket to the Help Desk for licensing assistance.
Upgrading
Existing users of commercial editions of JSCAPE MFT Server are entitled to 1 year of free upgrades and technical support. To obtain access to the latest version please contact JSCAPE via the Help Desk .
Upgrade Process - Graphical User Interface
This process is available only to versions 6.2 and above when using GUI installer. Upgrades may only be performed against versions 5.0 or above. If you are currently using a version prior to 5.0 then you must uninstall/delete current version and reinstall/reconfigure new version.
1. Run the GUI installer for JSCAPE MFT Server.
2. When prompted where to install JSCAPE MFT Server select the same installation directory as your current installation.
3. The installer for JSCAPE MFT Server will detect that a previous version of JSCAPE MFT Server is installed and will prompt you for a directory in which the current version may be backed up.
4. Continue with the installation process as normal. Once installation is complete your server configuration settings from previous version will be automatically migrated from previous version to current version.
Additional Notes
1. If you are managing your server remotely it is IMPORTANT that both the version of JSCAPE MFT Server
Manager used matches the version of JSCAPE MFT Server you are managing.
2. Any logos or text label settings that you have made to web interface WILL NOT be migrated during upgrade process.
3. Note, for Windows environments the JSCAPE MFT Server service will revert to using the Local System account after an upgrade. If JSCAPE MFT Server is accessing shared network resources (e.g. UNC paths) then you may need to update JSCAPE MFT Server service to use an account with access.
Upgrade Process - Manual
Upgrades may only be performed against versions 5.0 or above. If you are currently using a version prior to 5.0 then you must uninstall/delete current version and reinstall/reconfigure new version.
1. Shutdown JSCAPE MFT Server Service and JSCAPE MFT Server Manager.
2. Backup current JSCAPE MFT Server installation directory.
3. Uninstall current version of JSCAPE MFT Server.
4. Install updated version of JSCAPE MFT Server making sure to use same installation directory as previous install.
5. Shutdown JSCAPE MFT Server Service and JSCAPE MFT Server Manager.
6. Copy all *.dat, *.cfg, *.lic files and users (if exists) and domains directories from backup directory to current installation directory.
7. Copy all *.dat files from backup/etc directory to current installation/etc directory.
8. Copy any JDBC driver JAR files you have installed from backup libs/jdbc directory to libs/jdbc directory of current installation.
9. Copy any custom actions you have installed from backup libs/actions directory to libs/actions directory of current installation.
4 Chapter 1 Introduction
Introduction 1
10.Copy any custom authentication or 3rd party JAR from backup libs/ext to libs/ext directory of current installation.
11.Run the ./server-configuration command from within the installation directory. This will reconfigure the host/port and credentials used for the administrative service.
12.Restart JSCAPE MFT Server Service and JSCAPE MFT Server Manager.
Additional Notes
1. If you are managing your server remotely it is IMPORTANT that both the version of JSCAPE MFT Server
Manager used matches the version of JSCAPE MFT Server you are managing.
2. Any logos or text label settings that you have made to web interface WILL NOT be migrated during upgrade process.
License
JSCAPE MFT SERVER LICENSE STATEMENT AND LIMITED WARRANTY
IMPORTANT - READ CAREFULLY
This license statement and limited warranty constitutes a legal agreement ("License Agreement") between you (either as an individual or a single entity) and JSCAPE, LLC. ("JSCAPE") for the software product
("Software") identified above, including any software, media, and accompanying on-line or printed documentation.
BY INSTALLING, COPYING, OR OTHERWISE USING THE SOFTWARE, YOU AGREE TO BE BOUND
BY ALL OF THE TERMS AND CONDITIONS OF THE LICENSE AGREEMENT.
Upon your acceptance of the terms and conditions of the License Agreement, JSCAPE grants you the right to use the Software in the manner provided below.
This Software is owned by JSCAPE and is protected by copyright law and international copyright treaty.
Therefore, you must treat this Software like any other copyrighted material (e.g., a book), except that you may either make one copy of the Software solely for backup or archival purposes or transfer the Software to a single hard disk provided you keep the original solely for backup or archival purposes.
You may transfer the Software and documentation on a permanent basis provided you retain no copies and the recipient agrees to the terms of the License Agreement. Except as provided in the License Agreement, you may not transfer, rent, lease, lend, copy, modify, translate, sublicense, time-share or electronically transmit or receive the Software, media or documentation.
You acknowledge that the Software is a confidential trade secret of JSCAPE and therefore you agree not to reverse engineer, decompile, or disassemble the Software. You further acknowledge and agree that you may not use the Software to create any product or service that directly or indirectly competes with the
Software or any JSCAPE offering.
ADDITIONAL LICENSE TERMS FOR SOFTWARE
EVALUATION LICENSE
Chapter 1 Introduction 5
6
Introduction 1
JSCAPE grants to you (either an individual or single entity) nonexclusive license to install and use the
Software free of charge for evaluation purposes in a non-production environment. You may redistribute the software free of charge as long as the software and documentation are maintained in their original form.
PROFESSIONAL AND ENTERPRISE EDITIONS
JSCAPE grants to you (either an individual or single entity) non-exclusive license to install and use a single instance of JSCAPE MFT Server on a single computer. JSCAPE MFT Server may not be shared, installed or used concurrently on different computers without purchasing a separate license for each computer. If you wish to install multiple instances of JSCAPE MFT Server then a separate license MUST be purchased for each instance of JSCAPE MFT Server that is installed. If you are using any virtualization technology then a separate license MUST be purchased for each environment which uses JSCAPE MFT Server.
The JSCAPE MFT Server Manager, a client graphical user interface used for managing a JSCAPE MFT
Server installation, as well as API libraries needed for communicating with an instance of JSCAPE MFT
Server, may be installed on additional computers that you own without charge.
PRODUCT ACTIVATION
You may need to activate the Software through the use of the Internet. You agree that JSCAPE may use such measures for license management purposes and that JSCAPE may revoke a Software license if requested by you for purposes of moving Software to a different machine or for 60 days or more of nonpayment of Software license fees.
LIMITED WARRANTY
JSCAPE warrants that the Software, as updated and when properly used, will perform substantially in accordance with the accompanying documentation, and the Software media will be free from defects in materials and workmanship, for a period of ninety (90) days from the date of receipt. Any implied warranties on the Software are limited to ninety (90) days. Some states/jurisdictions do not allow limitations on duration of an implied warranty, so the above limitation may not apply to you.
This Limited Warranty is void if failure of the Software has resulted from accident, abuse, or misapplication.
Any replacement Software will be warranted for the remainder of the original warranty period or thirty (30) days, whichever is longer.
The above warranty DOES NOT apply to any BETA software, any software made available for testing or demonstration purposes, any temporary software modules or any software for which JSCAPE does not receive a license fee. All such software products are provided AS IS without any warranty whatsoever.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, JSCAPE AND ITS SUPPLIERS
DISCLAIM ALL OTHER WARRANTIES AND CONDITIONS, EITHER EXPRESS OR IMPLIED, INCLUDING,
BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE, TITLE, AND NON-INFRINGEMENT, WITH REGARD TO THE SOFTWARE, AND THE
PROVISION OF OR FAILURE TO PROVIDE SUPPORT SERVICES. THIS LIMITED WARRANTY GIVES
YOU SPECIFIC LEGAL RIGHTS. YOU MAY HAVE OTHERS, WHICH VARY FROM STATE/
JURISDICTION TO STATE/JURISDICTION.
LIMITATION OF LIABILITY TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO
EVENT SHALL JSCAPE OR ITS SUPPLIERS BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT,
OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES
FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS
INFORMATION, OR ANY OTHER PECUNIARY LOSS) ARISING OUT OF THE USE OF OR INABILITY TO
USE THE SOFTWARE PRODUCT OR THE PROVISION OF OR FAILURE TO PROVIDE SUPPORT
Chapter 1 Introduction
Introduction 1
SERVICES, EVEN IF JSCAPE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
BECAUSE SOME STATES AND JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF
LIABILITY, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.
HIGH RISK ACTIVITIES
The Software is not fault-tolerant and is not designed, manufactured or intended for use or resale as on-line control equipment in hazardous environments requiring fail-safe performance, such as in the operation of nuclear facilities, aircraft navigation or communication systems, air traffic control, direct life support machines, or weapons systems, in which the failure of the Software could lead directly to death, personal injury, or severe physical or environmental damage ("High Risk Activities"). JSCAPE and its suppliers specifically disclaim any express or implied warranty of fitness for High Risk Activities.
U.S. GOVERNMENT RESTRICTED RIGHTS
The Software and documentation are provided with RESTRICTED RIGHTS. Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraphs ©(1)(ii) of the Rights in Technical
Data and Computer Software clause at DFARS 252.227-7013 or subparagraphs ©(1) and (2) of the
Commercial Computer Software-Restricted Rights at 48 CFR 52.227-19, as applicable.
GENERAL PROVISIONS
This License Agreement may only be modified in writing signed by you and an authorized officer of
JSCAPE. If any provision of this License Agreement is found void or unenforceable, the remainder will remain valid and enforceable according to its terms. If any remedy provided is determined to have failed for its essential purpose, all limitations of liability and exclusions of damages set forth in the Limited Warranty shall remain in effect.
This License Agreement shall be construed, interpreted and governed by the laws of the State of Delaware,
U.S.A. This License Agreement gives you specific legal rights; you may have others which vary from state to state and from country to country. JSCAPE reserves all rights not specifically granted in this License
Agreement.
TECHNICAL SUPPORT AND UPGRADES
Technical support and upgrades is available to all registered users free of charge for a period of one year after date of purchase. All technical support questions are to be submitted to the JSCAPE help desk available online at http://help.jscape.com for a prompt reply. Following the first year of use, users may optionally purchase an annual maintenance agreement ("Subscription") which entitles them to another year of free upgrades and technical support. The rate for Subscription is 30% of the current license fee.
CUSTOM DEVELOPMENT
JSCAPE may on occasion collaborate with you on the development of new features in the Software. In some cases this development may be done for a negotiated fee between you and JSCAPE. You acknowledge and agree that any such development is exclusive property of JSCAPE and waive any and all rights to intellectual property created as a result of aforementioned development.
INCORPORATED SOFTWARE
This Software incorporates various 3rd party libraries and open source software. These libraries and their respective license agreements may be found in the libs directory relative to the Software installation directory.
7 Chapter 1 Introduction
8
Introduction 1
Version history
Release 9.2
Jul. 10, 2015
Enhancement: Improved performance for storing, rendering and searching of AS2 and OFTP messages.
Enhancement: Added OFTP messages module providing ability to see OFTP messages exchanged.
Enhancement: Added dashboard to web interface for tracking various performance metrics of server over time. Metrics include threads, heap memory, max memory, allocated memory, connections, uploads and downloads.
Enhancement: Added support for OpenID Connect standard in SSO authentication module and verified compatibility with Google Apps.
Enhancement: Updated Disable Inactive Accounts trigger action to include accounts that have never logged in.
Enhancement: Added ability to define From email header for AS2 messages.
Enhancement: Added option to edit immediately after copying a Trigger, User or Trading Partner.
Enhancement: Updated reports output format to be more consistent with administrative web interface.
Update: Updated code signing certificate for file transfer applet used in web interface.
Bug Fix: Resolved issue with GetGlobalVariable function not working properly when testing a condition in a trigger.
Bug Fix: Resolved various interoperability issues with SFTP clients.
Bug Fix: Resolved issue with passive ports not displayed correctly in web interface for FTP/S services.
Bug Fix: Resolved issue with SFTP related trigger actions where password authentication is preferred even though private key is specified.
Bug Fix: Resolved various minor issues.
Release 9.1
Feb. 13, 2015
Enhancement: Added ability to search tables in administrative web interface.
Enhancement: Added progress dialog to web interface when loading a domain.
Enhancement: Added Last Login column to Users table view.
Enhancement: Added status message to administrative web interface when saving changes.
Enhancement: Added support for TFTP and OFTP services.
Enhancement: Added support for Amazon S3, TFTP, OFTP, REST, IMAP, SMTP and POP3 in Trading
Partners module.
Enhancement: Added support for various protocols to Reverse Proxies module including Amazon S3,
REST, TFTP and OFTP.
Enhancement: Added pagination support to AS2 Messages and Contacts modules.
Enhancement: Added notification message to web interface when rebuild index process is started via
Server > Settings > Search Index.
Enhancement: Minor updates to user interface for Reverse Proxies module.
Enhancement: Updated all data tables to use consistent data alignment best practices.
Enhancement: Added visual cues to the web administrative interface that prompt user to save changes in the event they attempt to navigate away from page without saving changes.
Enhancement: Added support to automatically detect whether JavaScript and/or cookies are enabled in client's browser.
Enhancement: Updated all drop-down GUI components in web administrative interface to be searchable.
Enhancement: Added XSS and CSRF validation to all requests in both client and administrative web interfaces.
Enhancement: Added js-syncstate command line utility for performing failover synchronization.
Enhancement: Added DateAdd, DateSubtract and DateFormat trigger functions for use in manipulating and formatting dates.
Enhancement: Added Key column in Services module to display the server encryption key used by a service.
Chapter 1 Introduction
Introduction 1
Enhancement: Added Domains attribute to Server Key in Key Manager that displays a list of the domains currently using selected key.
Enhancement: Added ability to run actions asynchronously for a Trigger.
Enhancement: Added ability to view event details for an executed Trigger.
Enhancement: Added a unique event ID attribute that identifies the event used in the execution of a Trigger.
Enhancement: Added ability to require user to submit form data when uploading files via the client web interface.
Enhancement: Added alternative Label field to be used when presenting file upload forms to web based clients.
Update: Changed name of two-factor authentication service PhoneFactor to Microsoft Azure Multi-Factor
Authentication.
Bug Fix: Resolved compatibility issue with OpenID CAS server.
Bug Fix: Resolved backward compatibility issue with 8.4.
Bug Fix: Resolved issue related to known SSLv3 (POODLE) vulnerability.
Bug Fix: Resolved issue where user is not automatically redirected to login page in event of session timeout.
Bug Fix: Resolve password compliance validation issue when creating or editing a user's password.
Bug Fix: Fixed issue where first entry of new user activity log file is written to previous log file when server is inactive for several days.
Bug Fix: Fixed performance issue with Directory Monitors module.
Bug Fix: Various interoperability fixes for AS2 protocol.
Bug Fix: Fixed issue with file uploads that use a form with option to prompt user for form data for each file uploaded in a batch.
Bug Fix: Various bug fixes for web administrative client interface.
Release 9.0
Jul. 8, 2014
Enhancement: Added web based administrative user interface.
Enhancement: Added support for password protected archives in ZIP related trigger actions.
Enhancement: Added ability to ignore trigger events when domain is paused or stopped.
Enhancement: Added CurrentTimeMillis event variable to all trigger events.
Enhancement: Added relevant AS2 event variables to External File Upload event.
Enhancement: Password field is now optional in SQL related trigger actions.
Enhancement: Added option to relevant authentication modules that converts username to lowercase/ uppercase when creating virtual directory paths that rely on username information. Useful in environments where authentication is case-insensitive, but filesystem is case sensitive.
Enhancement: Added ability to download one or more files/directories from web interface as a ZIP archive.
Enhancement: Added ability to store ad-hoc file transfer details in a relational database.
Enhancement: Added ability to receive AS2 messages without requiring user credentials.
Enhancement: Added Data Connection Error event that is raised when data connection over FTP/S protocols experiences a timeout or other error.
Bug Fix: Resolved various miscellaneous issues.
Release 8.8
Dec. 2, 2013
Enhancement: Added Used variable to Directory Monitor Quota Exceeded event which captures the amount of storage data used.
Enhancement: Updated MIGLayout library used in JSCAPE MFT Server Manager.
Enhancement: Added ability to set optional Reply To address when sending ad-hoc emails.
Enhancement: Added support for optional web SSO authentication with support for SAML and OpenID
Chapter 1 Introduction 9
10
Introduction 1 authentication providers.
Enhancement: Added support for multipart emails when sending ad-hoc emails to include both text and
HTML versions.
Enhancement: Added support for templates when sending ad-hoc emails.
Enhancement: Added support for Cc and Bcc headers when sending ad-hoc emails.
Enhancement: Added ability to set the Host and Port parameters when sending ad-hoc emails using Ad
Hoc Email File Transfer trigger action.
Enhancement: Added ability to manage server, host, client and PGP keys from administrative web interface.
Enhancement: Added ability to request CAPTCHA information to be entered during login.
Enhancement: Added ability to display maximum number of downloads in ad-hoc email messages.
Enhancement: Added Sql Query trigger action that allows for exporting of database queries to a CSV file.
Enhancement: Updated FTP protocol implementation to improve memory usage.
Enhancement: Added User Detail metric to reporting module that aggregates and reports on data at user level.
Enhancement: Added warning message when user attempts to connect with JSCAPE MFT Server using a version of JSCAPE MFT Server Manager that is not compatible.
Enhancement: Added support for failover synchronization of ad-hoc file transfers.
Enhancement: Improved performance for large quantities of ad-hoc file transfers.
Enhancement: Improved Java applet file transfer client.
Enhancement: Remove Upload button from web interface if upload permissions are not enabled.
Enhancement: Added ability to restrict Banned Files entries to a Path that may be recursive.
Enhancement: Added time and throughput information to logging format and various reporting metrics.
Enhancement: Improved performance of ad-hoc file transfers.
Bug Fix: Resolved issue experienced by domain administrators when trying to edit a user from the web interface.
Bug Fix: Resolved issue with incorrect logo being used in web interface.
Bug Fix: Resolved issue with reverse proxies mapped to a remote SFTP service that resulted in reverse proxy being unavailable.
Bug Fix: Resolved issue with trading partners duplicated in user interface.
Bug Fix: Resolved issue with missing Revoke and Extend button text/image in web interface.
Bug Fix: Resolved issue with some SFTP uploads to server stalling at around 1GB.
Bug Fix: Miscellaneous bug fixes.
Release 8.7
Jul. 12, 2013
Enhancement: Added iOS client to Enterprise edition for use in transferring, viewing and sharing files.
Enhancement: Added support for AS2 service.
Enhancement: Added support for AS2 trading partners.
Enhancement: Added AS2 support to trading partner related trigger actions.
Enhancement: Improved SFTP service performance.
Enhancement: Improved error message returned in the event user attempts to use a previously used password that violates password compliance settings.
Enhancement: Trigger module now displays an error message in the event user tries to run a trigger that has not been saved.
Enhancement: Added Max connections/user option to Connections module.
Enhancement: Added ability to prefer AFTP protocol when using Java applet v.s. WebDAV protocol.
Enhancement: Ad-hoc file transfer passwords are now automatically trimmed to prevent validation errors during copy/paste.
Enhancement: Updated Branding URL module so that it is applied to Logout, Reset Password and
Registration pages.
Enhancement: Added client REST API functions for retrieving tags.
Enhancement: Improved usability and syntax handling of functions and variables in Triggers module.
Chapter 1 Introduction
Introduction 1
Enhancement: Added Delete On Upload/Delete On Download options to all Regex File Upload/Download trigger actions.
Enhancement: Improved resource editor in Server > Settings > Email > Resources panel.
Enhancement: Updated User and User Template panels to be more intuitive.
Enhancement: Redesigned Trading Partners user interface.
Enhancement: Added a js-triggersreport command line utility that will provide a report of all triggers, actions and settings.
Enhancement: Added support for various SHA2 MAC ciphers used in SFTP service.
Enhancement: Improved server0.log rotation logic so that it is not automatically rotated on restart.
Enhancement: Redesign of Domain Administration panels for User and User Template.
Enhancement: Added AuthenticationMethod property to User Login event.
Enhancement: Added asynchronous execution support to trigger definitions.
Bug Fix: Changed default encoding of Country attribute in server certificates from UTF8 to ASCII.
Bug Fix: Resolved zlib issue with SFTP service.
Bug Fix: Resolved a number of issues with File Transfer Command Line langage used in File Transfer
Script trigger action.
Bug Fix: Resolved issue where rebuilding index causes tags to be lost.
Bug Fix: Resolved issue with Trading Partner Rename File action.
Bug Fix: Resolved issue with Trading Partner Create Directory action.
Bug Fix: Resolved issue where variables could not be used in the Email field for a user in a User Template.
Bug Fix: Resolved issue where HTTP sessions were not properly closed.
Bug Fix: Resolved issue where File Download event was fired for failed SFTP file downloads.
Bug Fix: Fixed performance issue experienced when navigating to a remote directory that is mapped to a reverse proxy when using Java applet.
Bug Fix: Updated indexing engine to prevent locking issues.
Bug Fix: The Runtime column in Triggers > Recent panel now displays updated time for running triggers.
Bug Fix: Resolved issue where settings in Server > Settings > Web > Resources were not being maintained across upgrades.
Bug Fix: Resolved issue displaying large PDF files in web document viewer.
Bug Fix: Resolved issue with case-insensitive user names.
Bug Fix: Resolved issue with testing reverse proxy mapped to a WebDAV service.
Bug Fix: Resolved issue authenticating with SSL based LDAP service.
Bug Fix: Resolved issue where user was able to tag non-existing files using REST API.
Bug Fix: Resolved issue with ReplaceAll function in Triggers module.
Bug Fix: Resolved issue where users are unable to download files that are tagged within a sub-directory.
Bug Fix: Resolved issue where users are unable to navigate to a tagged directory.
Bug Fix: Resolved exception thrown in Aftp Create Directory action.
Bug Fix: Resolved issue with Trading Partner Regex File Upload action.
Bug Fix: Resolved retry issue with Trading Partner related trigger actions.
Release 8.6
Mar. 8, 2013
Enhancement: Various performance improvements to AFTP protocol.
Enhancement: Added support for specifying default selected user interface option when logging in via web interface.
Enhancement: Updated SFTP and SCP related trigger actions to use extended cipher set.
Enhancement: Updated trigger actions to allow for use of variables in all input elements.
Enhancement: Improved SSL/TLS Cipher Suites panel for FTPS and HTTPS protocols.
Enhancement: Added support for disabling CAPTCHA during web based self-registration.
Enhancement: Added ability to prioritize, pause and resume a number of trigger actions.
Enhancement: Updated web interface to automatically save virtual paths and IP access rules when changed.
Enhancement: Updated SFTP trigger actions, reverse proxies and trading partners to support extended set
Chapter 1 Introduction 11
Introduction 1 of ciphers.
Enhancement: Updated client web interface to provide protection against CSRF (Cross-Site Request
Forgery) attacks.
Enhancement: Updated web interface so the View icon is only enabled for those document types supported by web document viewer.
Enhancement: Updated web document viewer to display a user friendly error message in the event that a document cannot be displayed.
Enhancement: Added client REST API for use in performing file transfers, ad-hoc file transfers and contact management.
Enhancement: Added support for displaying SWF files in web document viewer.
Bug Fix: Resolved issue where administrator is unable to update a Contact name in JSCAPE MFT Server
Manager.
Bug Fix: Resolved failover synchronization issues.
Bug Fix: Resolved issue where REST services are not automatically started after failover synchronization.
Bug Fix: Resolved unresponsive Cancel button when deleting a Contact, URL Branding or Drop Zone via the web interface.
Bug Fix: Resolved issue with canceling Check Email trigger action.
Bug Fix: Resolved class name obfuscation issues in management API.
12
Release 8.5
Jan. 11, 2013
Enhancement: Added REST API for use in managing JSCAPE MFT Server.
Enhancement: Added web administration interface for adding, deleting, starting, stopping and pausing domains.
Enhancement: Updated web document viewer to be automatically included as part of JSCAPE MFT Server
Enterprise Edition release.
Enhancement: Added ability to specify whether ports are included in HTTP headers.
Enhancement: Added ability to tag multiple documents simultaneously via the web interface.
Enhancement: Added Run button to Directory Monitors module providing ability to run a directory monitor manually.
Enhancement: Improved performance for ad-hoc file transfers.
Enhancement: Added ability to optionally include all event properties as part of request in Http Request trigger action.
Enhancement: Automatically remove leading and trailing spaces from input fields in JSCAPE MFT Server
Manager prior to saving.
Enhancement: Added ability to enable/disable display of certain sections in My Account page at User and
User Template levels.
Enhancement: Added GetUserInfo function for use in trigger actions to retrieve information on a user account.
Enhancement: Added IsUserMemberOfGroup function for use in trigger actions to check if a user is a member of a group.
Enhancement: Updated Key Manager to prompt user to save keys if they attempt to exit Key Manager with unsaved changes.
Enhancement: Added optional Reply To field in Send Email action.
Enhancement: Updated client web interface in steps towards 508c compliance.
Enhancement: Numerous usability updates to Java applet used in web interface.
Bug Fix: Resolved issue with virtual paths being duplicated when a domain administrator adds a user via web interface.
Bug Fix: Resolved issue with users being unable to use WebDAV/Java applet when username contain @ symbol.
Bug Fix: Resolved issue with saving directory monitors.
Bug Fix: Resolved issue with LDAP authentication modules where LDAP port value was overridden with
LDAP timeout value.
Chapter 1 Introduction
Introduction 1
Bug Fix: Resolved issue with js-adduser command line utility where user password change rights were not matching that of the template used.
Bug Fix: Updated regular expression for US SSN to prevent identifying certain credit card data as US SSN.
Bug Fix: Resolved issue with password history not working correctly in some unique cases.
Bug Fix: Resolved issue with PGP encrypted virtual directories not working correctly.
Bug Fix: Resolved issue with importing and using PGP public keys.
Bug Fix: Resolved issue with default web view for accounts.
Bug Fix: Resolved issues in Zip Directory and System Configuration Backup actions that resulted in invalid
ZIP archives being created.
Bug Fix: Resolved internal error message when trying to add a virtual path via web interface.
Bug Fix: Resolved issue experienced in some accounts requiring a password change on first time login.
Bug Fix: Resolved issue with Ad Hoc File Transfer action where incorrect port value of 0 may be used if email.url.host value is set but email.url.port value is not set.
Bug Fix: Resolved issue where incorrect error message displayed if user is denied access due to user level
IP Access rules.
Bug Fix: Resolved issue where changes made by a domain administrator to the "Allow password change" option for an account are not saved when updating user via web interface.
Release 8.4
Aug. 14, 2012
Enhancement: Major upgrade to the JSCAPE MFT Server Manager user interface in order to more effectively support multiple domains and reduce overall memory and CPU consumption.
Enhancement: Added automatic ssl.cfg update to work with graphical installers using IBM JVM.
Enhancement: Added optional expiration date to ad-hoc file transfers allowing users to send non-expiring ad-hoc file transfers.
Enhancement: Added ability for users to register for new accounts using the web interface.
Enhancement: Improved update process so that customizations made to language files are not lost during an upgrade.
Enhancement: Added optional argument to specify a user template when using the js-adduser command line utility.
Enhancement: Added ability to test SMTP server settings and send a test email message.
Enhancement: Improved error message displayed when invalid credentials are entered and manual synchronization is performed.
Enhancement: Improved firewall support for remote JMX sessions providing settings for both server and registry ports.
Enhancement: Various performance enhancements made to the AFTP protocol.
Enhancement: Changed "Monitor interval (sec)" field for directory monitors to be optional allowing for directory monitors to be run on demand or on a scheduled basis using the newly added Run Directory
Monitor trigger action.
Enhancement: Several updates to the Java applet user interface.
Enhancement: Various performance enhancements to SFTP protocol.
Enhancement: Updated triggers module to retain recent trigger history regardless of whether changes are made to triggers.
Bug Fix: Resolved issue where some command line utilities would raise an exception when used in combination with custom trigger actions.
Bug Fix: Resolved issue where user was unable to resume a canceled file transfer in Java applet window.
Bug Fix: Resolved issues experienced with reverse proxies when "Map current local directory to remote directory" option was enabled.
Bug Fix: Resolved variable expansion issue experienced in the email.lostpassword.body and email.lostpassword.subject resource properties.
Bug Fix: Resolved issue where PGP keys exported from JSCAPE MFT Server cannot be imported into
GnuPG 2.x.
Bug Fix: Resolved issue where failover IP substitution does not work correctly under automatic
Chapter 1 Introduction 13
14
Introduction 1 synchronization.
Bug Fix: Resolved issue in Convert File trigger action where UNIX to MS-DOS conversions were not working correctly.
Bug Fix: Resolved issue where adding a duplicate account via JSCAPE MFT Server Manager correctly results in an error message but incorrectly lists duplicate account in users list.
Bug Fix: Resolved issue where "Current connections" and "Total connections since start" values reported by JSCAPE MFT Server Manager are corrupted from incoming WebDAV connections.
Release 8.3
May 9, 2012
Enhancement: Added support for streaming compression to AFTP protocol.
Enhancement: Added ability to use search results as argument to a report.
Enhancement: Added ability to re-run a report.
Enhancement: Updated syntax for functions to be consistent across trigger conditions and actions parameters.
Enhancement: Added GetPathSeparator function in triggers module to return the OS specific path separator used.
Enhancement: Disabled form auto-complete in web interface for sensitive fields.
Enhancement: Updated login and account reset password error messages to prevent attackers from trying to guess valid usernames.
Enhancement: Added HttpOnly flag to session cookie to prevent session information from being potentially exposed to scripts.
Enhancement: Added input validation for all fields in web interface to prevent potential XSS attacks.
Enhancement: Added old password verification when changing password via web interface, requiring that users enter their old password to set a new password.
Enhancement: New session ID is now generated after login when using web interface.
Enhancement: Exposed syslog service descriptor in management API.
Enhancement: Added check to prevent importing of certificates into key manager without a valid matching private key.
Enhancement: Improved memory consumption in Java applet and improved progress monitor when transferring directories.
Bug Fix: Resolved issue with DLP module that could release files that have been modified but not yet reindexed.
Bug Fix: Resolved issue where user could not rename a file if download permissions were not granted.
Bug Fix: Resolved issue in SFTP protocol where IP may be blocked but user is still able to perform authentication attempts using an existing connection.
Bug Fix: Resolved memory leak issue when performing failover synchronization.
Bug Fix: Resolved issue with potential socket timeouts in automatic failover synchronization.
Bug Fix: Resolved issue of uploading files to server over SCP using wildcards.
Bug Fix: Resolved issue when using shared review capabilities in Acrobat Pro with WebDAV service.
Bug Fix: Resolved issue of no data being presented when generating report using same start date and end date arguments.
Bug Fix: Resolved issue regarding use of variables in email.password.subject property when performing adhoc file transfers.
Bug Fix: Resolved issue with FTPS protocol where if download permission is not granted and user attempts to download a file a data connection channel is never opened by server resulting in data channel timeout by some clients.
Bug Fix: Resolved issue with Run Process action hanging when using Windows powershell script.
Bug Fix: Resolved issue where the "Uploaded since start" value displayed in JSCAPE MFT Server Manager is incorrectly incremented by two for each file uploaded when using SFTP protocol.
Bug Fix: Resolved potential memory issue experienced when using verbose database logging.
Bug Fix: Resolved authentication issue experienced when connecting to ApacheDS LDAP service.
Bug Fix: Resolved issue with potential incorrect remote directory used in Trading Partner Regex File
Download action.
Chapter 1 Introduction
Introduction 1
Bug Fix: Resolved issue with IP/host not being properly saved when making changes to JMX settings.
Bug Fix: Resolved text label issue with dialog displayed in IE when attempting to overwrite an existing file.
Release 8.2
Feb. 20, 2012
Enhancement: Added support for listing available domains in a domain drop-down field when logging in via web interface.
Enhancement: Added AFTP file transfer actions to triggers module.
Enhancement: Added check to see whether a private key is in use before allowing key to be deleted from
Key Manager.
Enhancement: Added sessionid variable which reports a unique session ID for user operations that are part of a user session. The sessionid variable is available for use in triggers module.
Enhancement: Added GetFileExists and GetFileSize functions to triggers module. These functions may be used to check whether a file exists and it's size.
Enhancement: Updated progress dialog from modal to non-modal.
Enhancement: Added ability to pause/resume in Running log view.
Enhancement: Added labels to date fields specifying expected date format.
Enhancement: Added support for PEM and PKCS#8 formats when exporting a private client key.
Enhancement: Added ability to export private server keys.
Enhancement: Added "none" to default list of supported compression types for SFTP service.
Update: Removed support for Flash uploads. All uploads are now performed using native file upload capabilities of browser.
Bug Fix: Resolved file locking issue in AFTP service.
Bug Fix: Resolved error with Chrome and IE browsers connecting using SSL.
Bug Fix: Resolved issue with Sftp File Upload action when Overwrite If File Exists option is enabled.
Bug Fix: Resolve line termination issue for directory listings when using FTP/S protocols.
Bug Fix: Resolved lexical processing error experienced with web upload form variables used in trigger conditions.
Bug Fix: Resolved issue experience when sending email to/from long email addresses.
Bug Fix: Resolved issue with incorrectly reported Current transfers value as reported in JSCAPE MFT
Server Manager.
Bug Fix: Resolved issue in Ftp Regex File Download action that would attempt to download a matching directory.
Bug Fix: Resolved issue with importing SSH public keys.
Bug Fix: Resolved issue with non-existing file being returned in directory listings.
Release 8.1
Jan. 14, 2012
Enhancement: Complete rewrite of the AFTP protocol providing for accelerated file transfers over high latency networks.
Enhancement: Added support for password policies when generating passwords for ad-hoc email file transfers.
Enhancement: Updated UI for trading partners module.
Enhancement: Added ability to create a drop zone from the management API.
Enhancement: Added support for multi-word phrases when tagging files via web interface.
Enhancement: Added ability to specify what SSL/TLS protocols are used.
Enhancement: Added ability to specify a footer message that is appended to all ad-hoc email file transfers.
Enhancement: Added support for limiting what top level domains (TLD) and/or email addresses an ad-hoc email file transfer may be sent to.
Enhancement: Added additional reporting to activity log showing when a trigger is queued and finished.
Enhancement: Added host key verification support to FTPS, SFTP and SCP related actions and trading partners module.
Chapter 1 Introduction 15
Introduction
Enhancement: Redesigned Key Manager and added section for managing host keys.
Update: Updated license agreement removing SaaS usage restriction.
Bug Fix: Resolved gradual memory leak experienced often over several weeks.
Bug Fix: Resolved CPU utilization issue when connecting to web server using IE 9 browser.
Bug Fix: Resolved issue where a trigger will not fire and nothing is reported to the log in cases where maximum trigger resource limit is reached.
Bug Fix: Fixed issue with dialog disappearing after uploading a file using a drop zone.
Bug Fix: Fixed issue with JMX service not properly releasing port when JMX service is disabled.
1
16
Release 8.0
Sep. 1, 2011
Enhancement: Added DLP (data loss prevention) module available in Enterprise edition.
Enhancement: Redesign of Logging module to provide more visibility into user activity.
Enhancement: Added support for OpenPGP encrypted virtual directories.
Enhancement: Added support for multiple administrators.
Enhancement: Improved memory performance for directory monitors.
Enhancement: Improved memory performance for search indexing.
Enhancement: Added ability to send passwords for ad-hoc file transfers out-of-band.
Enhancement: Added support for selecting multiple files for upload when using HTML user interface.
Enhancement: Added ability to extend scope of Banned Files module to include directories.
Enhancement: Implemented various usability and performance enhancements to user interface in JSCAPE
MFT Server Manager application.
Enhancement: Added ability to create contacts while creating an ad-hoc file transfer.
Enhancement: Added Trading Partner Directory Upload Synchronization and Trading Partner Directory
Download Synchronization actions.
Enhancement: Added passive setting for Directory Upload Synchronization and Directory Download
Synchronization actions.
Enhancement: Added support for IPv6 addresses in web services.
Enhancement: Added ability to move files and folders on server using drag and drop.
Enhancement: Added a Disable Inactive Accounts action.
Enhancement: Added column sorting support to Recent tab in Triggers module.
Enhancement: Added ability to force a user to change their password upon first login via web interface.
Enhancement: Added optional Time Expression dialog for use in creating scheduled triggers when using
Current Time event.
Enhancement: Updated a number of file transfer related actions in Triggers module moving advanced connection parameters to an Advanced tab.
Bug Fix: Fixed issue where AFTP UDP and AFTP TCP services could not listen on the same port.
Release 7.2
Apr. 18, 2011
Enhancement - Added experimental AFTP (Accelerated File Transfer Protocol) service designed to provide file transfers over low latency networks using UDP or TCP protocols.
Enhancement - Added support for SCP protocol to SFTP service.
Enhancement - Added status of domain next to domain node.
Enhancement - Added ability to pause a domain in order to stop accepting new connections.
Enhancement - Added js-copyusers utility that allows for copying or migrating users from one domain to another
Enhancement - Added ability to specify a private key for for SFTP Reverse Proxy and client certificate for
FTPS Reverse Proxy.
Enhancement - Added server.vmoptions to System Configuration Backup action
Enhancement - Added a js-importcontacts utility for importing contacts
Enhancement - Added NewAccount attribute to Account Updated event in order to detect when a new
Chapter 1 Introduction
Introduction 1 account is created
Enhancement - Added js-pausedomain in order to stop accepting new connections
Enhancement - Added js-resumedomain to resume accepting new connections
Enhancement - Added ability to view and manage previous ad-hoc file transfers from the web user interface
Enhancement - Added ability to perform an orderly server shutdown
Enhancement - Added ability to specify whether existing files should be overwritten when uploading files to a drop zone
Change - Default service type to explicit SSL when adding a new FTP service
Bug Fix - Fixed issue where condition expression was rewritten when saved
Bug Fix - Fixed issue where triggers could be created without using a unique name.
Bug Fix - Fixed documentation issue in Trading Partners module
Bug Fix - Fixed required field error in File > Settings > Email section of JSCAPE MFT Server Manager
Bug Fix - Fixed issue with Run Process action where double quotes are not stripped before passing argument to executing program
Bug Fix - Fixed issue where Banned Files are banned from upload but not from renaming.
Release 7.1
Nov. 14, 2010
Enhancement: Redesign and improved usability of condition builder in triggers module.
Enhancement: Added context sensitive help to triggers module for events, event variables, actions and functions.
Enhancement: Added contact management capabilities for use in ad-hoc file transfers.
Enhancement: Added ability to specify IP Access restrictions at user level.
Enhancement: Added ability to view/manage active sessions for all protocols.
Enhancement: Added multiple concurrent file transfer support to Java applet interface.
Enhancement: Added Company attribute to user accounts.
Enhancement: Added API support for managing remote directories.
Enhancement: Added File Upload Quota Exceeded, File Download Quota Exceeded and File Transfer
Quota Exceeded events that are fired when a transfer quota is exceeded.
Enhancement: Added ability to specify an optional command to be executed on remote FTP/S servers after login but prior to action execution for FTP/S related actions and trading partner definitions.
Enhancement: Added Twitter actions for sending direct messages and status updates.
Enhancement: Added ability to set session TTL for HTTP/S sessions.
Enhancement: Updated web interface so that Domain field is automatically populated in Lost Password screen if “Default domain” option is enabled.
Enhancement: Updated custom action API to support context sensitive help.
Enhancement: Updated tag cloud to be sorted in descending order.
Enhancement: Added ability to specify whether adaptive connection is used and whether subsystem reply is required in SFTP reverse proxy and SFTP action definitions.
Update: Renamed product to JSCAPE MFT Server to better reflect product capabilities.
Update: Replaced evaluation license with community license and changed limitations of community license to support up to 5 users/connections and 1 domain with all other functionality enabled.
Update: Changed reverse proxy definition to load optional private key used in SFTP and FTPS protocols from a file rather than load from “Server Keys” module.
Bug Fix: Resolved issue where trigger would not show up with Failed status under Recent tab of triggers module when using an invalid function definition.
Bug Fix: Resolved issue where datastore location could not be changed for a domain.
Bug Fix: Resolved issue with drop zones where uploading to a drop zone may not upload to the correct directory.
Bug Fix: Resolved issue with user passwords that contained a % character.
Bug Fix: Added missing image to Manage Tags button in web interface.
Bug Fix: Removed .svn directories from product distribution.
Release 7.0
17 Chapter 1 Introduction
18
Introduction 1
Aug. 18, 2010
Enhancement: Added ability to tag/search documents with keywords using the web interface for improved searching.
Enhancement: Added ability to store the credentials for remote systems using a new admin module called
Trading Partners.
Enhancement: Added ability to retry outgoing emails if failure occurs initially.
Enhancement: Added ability to allow a user to belong to more than one group.
Enhancement: Added ability to allow a user to connect to a different JSCAPE MFT Server without having to stop/start the JSCAPE MFT Server Manager.
Enhancement: Added ability to list & enable/disable users using the command line API.
Enhancement: Added ability to stop an administrator being able to delete their own account.
Enhancement: Added ability to manage large numbers of users via the GUI without sacrificing performance.
Enhancement: Added ability to import existing public keys and have them automatically converted to X.509
format.
Bug Fix: Fixed issue with API Doc and actual functionality being out of sync for AbstractAction.
Bug Fix: Fixed issue with Trigger concurrency limit now set per trigger and not across all triggers as previously.
Bug Fix: Fixed issue with Automatic login no longer working.
Bug Fix: Fixed issue with Default connection being overwritten, rather it should add a new connection to the list when adding a connection.
Release 6.6
Jun. 7, 2010
Enhancement: Added ability to check disk quota before a file upload (web interface) to ensure that disk quota will not be exceeded.
Enhancement: Added ability to store the last login date for a user.
Enhancement: Added ability to migrate changed text labels (web interface) so that they also appear postupgrade.
Enhancement: Added ability to access the server version number as a function in trigger actions.
Enhancement: Added ability to access the user group as a function in trigger actions.
Enhancement: Added ability to access the users root directory as a function in trigger actions.
Enhancement: Added ability to disable a user account as an action.
Enhancement: Added ability to define global parameters available to all trigger actions as a function.
Enhancement: Added ability to limit the number of concurrent triggers.
Enhancement: Added ability to print a report of all users and their attributes.
Enhancement: Added ability to list inactive/active users via the management API.
Enhancement: Added ability to specify a Secondary LDAP server for failover authentication purposes.
Enhancement: Added ability to remove an IP from IP Access list without domain restart.
Enhancement: Added option to specify if a remote file should overwritten (web interface).
Enhancement: Added ability to run a report showing expiring encryption keys.
Enhancement: Added ability to specify domains to startup on initialization.
Enhancement: Added ability to synchronize sub-folders when synchronizing directories in Directory Upload
Synchronization and Directory Download Synchronization actions.
Enhancement: Added ability to set user permissions via the command line in js-adduser, js-adduserdir, jsaddgroup and js-addgroupdir utilities.
Enhancement: Added ability to disable/resume file upload operation.
Enhancement: Added ability to cancel an upload when viewing a form.
Enhancement: Added ability to ensure that a user has download access before sending an email
Enhancement: Added ability to upload files anonymously using a Drop Zones module.
Enhancement: Added ability to specify multiple custom logos at a domain level using URL Branding module.
Enhancement: Added option to specify a section (Storage or My Account) to redirect users to upon login
(web interface).
Chapter 1 Introduction
Introduction 1
Enhancement: Added option to confirm overwriting existing files within applet.
Enhancement: Changed behavior of IP Access Rules Updated and IP Blocked events so that events are only fired if IP does not already exist in IP Access list..
Bug Fix: Fixed issue with missing comments against some API's.
Release 6.5
Mar. 31, 2010
Enhancement: Added js-passwd command line utility for use in changing account passwords.
Enhancement: Added ability to see recent (last 1000) trigger executions
Enhancement: Added ability to pass original event information to Trigger Error event using variables and
Trigger Error Message field.
Enhancement: Added ability to enable/disable ad-hoc email at the domain level.
Update: Removed update of directory monitor quotas when uploading/deleting files in order to avoid potential performance issues related to quota synchronization.
Bug Fix: Resolved issue with Check Email action where unique message ID used in storing messages contained illegal filename characters.
Bug Fix: Resolved issue experienced when using Adobe Flash upload component in Internet Explorer browser.
Release 6.4.0.4
Jan. 18, 2010
Enhancement: Added ability to use built-in functions within trigger actions.
Enhancement: Added ability to limit the user interface options available when using web client.
Enhancement: Added Login.FOOTER variable to File > Settings > Web > Resources for use in defining a footer in login page.
Enhancement: Added Zip Regex File action for use in creating ZIP file based on regular expression.
Enhancement: Added ability to define multiple connection settings in File > Settings > Connection panel for use in managing many remote servers.
Enhancement: Added restart script to server.
Bug Fix: Fixed issue with files not being properly overwritten when using SFTP reverse proxy.
Bug Fix: Fixed NullPointerException error experienced when upgrading previous version.
Release 6.3.0.6
Dec. 15, 2009
Enhancement: Added ability to specify banned files for upload.
Enhancement: Added ability to limit days of week and times that users may connect.
Enhancement: Added ability to specify continue argument without specifying login credentials when integrating web interface with external applications.
Enhancement: Added ability to password protect ad-hoc email links.
Enhancement: Removed requirement for specifying user account password in Ad Hoc Email File Transfer action.
Bug Fix: Fixed issue with ad-hoc email hostname used when server is installed in NAT environment.
Bug Fix: Fixed issue with ad-hoc email links becoming invalid if user changes account password.
Bug Fix: Fixed issue with creating reports.
Release 6.2.0.24
Nov. 17, 2009
Enhancement: Added upgrade wizard to GUI installer.
Enhancement: Added Rename permissions flag to virtual directories.
Enhancement: Improved parsing of ssl.cfg file.
Update: Changed private client key export so that both keystore and key are password protected.
Chapter 1 Introduction 19
20
Introduction 1
Bug Fix: Resolved issue with 0 bytes of data being reported in log file for ASCII downloads.
Bug Fix: Resolved line termination issue with directory listing commands in FTP/S protocols.
Release 6.2.0
Nov. 9, 2009
Enhancement: Added ability to specify link expiration range when performing ad-hoc email file transfers via web interface.
Enhancement: Improved performance for updating directory monitor and bandwidth quotas.
Enhancement: Added ability to require secondary level of authentication using client certificates in HTTP/S and WebDAV/S protocols.
Enhancement: Added ability to set cipher strength used in SSL protocols.
Enhancement: Added "Server name" field to File > Settings > Web panel. This may be used to specify an alternative host name when server is behind a NAT protected firewall in order to prevent leaking of internal
IP information.
Enhancement: Added Ad Hoc Email File Transfer action for performing ad-hoc email file transfers programmatically.
Bug Fix: Resolved issue with temporary files not being deleted that were created during indexing of PDF documents.
Release 6.1.0.60
Oct. 16, 2009
Enhancement: Added ability to specify a continue parameter in automatic login via URL.
Update: Added JavaDoc for Action and AbstractAction classes.
Bug Fix: Fixed issue with SSL and LDAP authentication modules.
Bug Fix: Fixed issue with phone authentication module.
Release 6.1.0.53
Oct. 5, 2009
Enhancement: Added ability to execute Current Time event triggers on demand.
Update: Changed maximum timeout values for FTP/S and SFTP protocols to 999 minutes.
Bug Fix: Fixed issue with public key authentication in SFTP protocol.
Release 6.1.0.50
Sep. 28, 2009
Enhancement: Added Copy Regex File and Move Regex File trigger actions.
Enhancement: Added Tar Directory action for creating a TAR archive of a directory.
Enhancement: Added Append File action for appending messages to a file.
Enhancement: Updated all SFTP related actions so that password is optional, providing support for password-less public key authentication.
Enhancement: Added ability to disable a trigger.
Enhancement: Updated Maximum password age field in Compliance panel to support up to 999 days.
Enhancement: Added ability to retrieve event variables within custom action code.
Enhancement: Added ability to sign and view signatures for OpenPGP keys.
Enhancement: Added ability to specify a hostname in Passive IP field allowing for IP resolution when using a dynamic IP.
Enhancement: Added Ftp Rename File, Ftps Rename File and Sftp Rename File trigger actions.
Enhancement: Added Ftp Create Directory, Ftps Create Directory and Sftp Create Directory trigger actions.
Enhancement: Added ability to specify JDBC connection pool size and time-to-live for connections in
Database Log and DB Datastore modules.
Enhancement: Added ability to select multiple files for upload in HTML user interface using optional Flash plug-in.
Chapter 1 Introduction
Introduction 1
Enhancement: Added ability to automatically start domain/services on failover server after synchronization.
Enhancement: Added additional information to server log to detect source of failed user authentications.
Enhancement: Added ability to set expected successful return code(s) using a regular expression in Run
Process trigger action.
Update: Changed logging level for client read timeout messages so they only show up in log with FINE logging level enabled.
Update: Changed "Test parameters" functionality in LDAP Query Authentication module to check filter parameters in addition to user authentication.
Update: Changed default setting for ""Create account if not found" option in various authentication modules to enabled.
Update: Various updates to API JavaDoc.
Update: Changed behavior in Failover module so that production server will startup even if failover server is down.
Bug Fix: Fixed issue with NTLM Authentication settings not being displayed properly when using multiple domains.
Bug Fix: Fixed issue with improper server response to EPSV command.
Bug Fix: Fixed issue with Delete Files Older Than property in Delete Files trigger action.
Bug Fix: Fixed issue with with logos not being updated properly in IE browser when using multiple domains with different logos.
Release 6.0
July 27, 2009
Enhancement: Added support for document (MS Word, Excel, PDF, text, HTML) indexing and searching via web interface.
Enhancement: Added ability to bypass password aging compliance at user level.
Enhancement: Added PGP fingerprint information to PGP view dialog.
Enhancement: Added ability to resize all dialogs in JSCAPE MFT Server Manager.
Enhancement: Added ability for users to generate public keys for use in public key authentication (SFTP) from web interface.
Enhancement: Added number of files deleted information to log when executing Delete Files action.
Bug Fix: Fixed issue with trigger flow when one or more actions fail.
Bug Fix: Fixed issue with "Browse subdirs" directory permissions.
Bug Fix: Fixed issue with File Upload event not being fired when using UNC paths.
Bug Fix: Fixed issue with password change reminder being sent at wrong time.
Bug Fix: Fixed issue with regular expressions in Delete Files action.
Bug Fix: Fixed issue with automatic inactivity logout dialogs in web interface.
Bug Fix: Fixed issue with copying User/Group in JSCAPE MFT Server Manager.
Bug Fix: Fixed issue with editing virtual path that uses a reverse proxy.
Bug Fix: Fixed issue with User Login event fired when login fails.
Release 5.2
Jun. 2, 2009
Enhancement: Added support for submitting custom form data when uploading files via HTML user interface.
Enhancement: Added ability to set syslog facility.
Enhancement: Added integration support for JSCAPE Web Document Viewer product. This product allows users to view documents on the server using a web based embedded document viewer.
Enhancement: Added integration support for JSCAPE MFT Server Plugin for Outlook. This product allows users to perform ad-hoc email file transfers directly from Outlook email clients.
Enhancement: Added ability to copy a group.
Enhancement: Added ability to copy a user.
Enhancement: Added IPv6 support for all protocols.
Bug Fix: Fixed issue with File Upload event being fired twice when using a reverse proxy.
21 Chapter 1 Introduction
Introduction
Bug Fix: Fixed path editing issue in JSCAPE MFT Server Manager
Bug Fix: Fixed issue with trigger action information being lost during upgrade.
1
Release 5.1
Mar. 30, 2009
Enhancement: Added support for enabling/disabling passive transfers in all FTP/FTPS related trigger actions.
Enhancement: Added retry interval property to all file transfer trigger actions to define the wait period before retrying a file transfer.
Enhancement: Added extension field to phone number.
Enhancement: Changed adhock.email.prebody variable in File > Settings > Email > Resources of JSCAPE
MFT Server Manager to use user's real name.
Enhancement: Added UsernameEmail and UsernameName variables to all trigger events that have
Username variable. These events allow for retrieval of the user's email address and real name respectively.
Bug Fix: Fixed issue in WebDAV protocol and Java Applet with properly escaping filenames.
Bug Fix: Fixed issue in that server was using random source port instead of expected port 20 for nonpassive transfers.
Bug Fix: Fixed NullPointerException experienced when using Database Query Authentication module.
Bug Fix: Fixed append issue experienced when using SFTP protocol.
22
Release 5.0
Feb. 23rd, 2009
Enhancement: Improved performance for PGP encryption and decryption actions.
Enhancement: Added token-less two-factor authentication support.
Enhancement: Improved performance for directory monitors.
Enhancement: Added ability to define a file latency period for a directory monitor.
Enhancement: Added ability to assign a directory monitor to a user.
Enhancement: Added check for whether file is being currently written to in a directory monitor.
Enhancement: Added ability to view bandwidth quotas and directory monitor quotas for a user via web interface.
Enhancement: Added built-in support for Spanish, French, German and Russian to web interface.
Enhancement: Updated LDAP Query Authentication module to support using different LDAP user credentials for authentication and search.
Enhancement: Added js-sendmessage command line utility for emailing all accounts for a domain.
Enhancement: Updated custom authentication API to support validation of client IP address.
Change: Updated system requirements to JVM 1.5 and above.
Bug Fix: Fixed issue with not returning error when creating a directory that already exists using FTP/S or
SFTP protocols.
Bug Fix: Fixed issue with setting bandwidth quotas under Professional license type.
Bug Fix: Fixed issue with Run Process trigger action.
Release 4.5
Jan. 26th, 2009
Enhancement: Added ability to hide domain and/or specify default domain used in web interface.
Enhancement: Added ability to accept multiple delivery addresses in ad-hoc email file transfer module.
Bug Fix: Fixed issue experienced when installing only the JSCAPE MFT Server Manager component using
GUI installer.
Bug Fix: Fixed issue with setting user bandwidth quotas under Professional edition.
Bug Fix: Fixed issue with expiration date information sent in password reminders.
Bug Fix: Fixed issue with resuming file transfers in SFTP protocol.
Chapter 1 Introduction
Introduction 1
Release 4.4
Dec. 26, 2008
Enhancement: Added Delete Accounts action to Triggers module for deleting expired or disabled accounts.
Enhancement: Added email address to manage users view in web interface.
Bug Fix: Fixed email notification service so email.url.host is used if entered.
Bug Fix: Fixed issue with PGP encrypting/decrypting files.
Bug Fix: Fixed issue with Send Email action throwing a NullPointerException.
Bug Fix: Fixed issue with backuplog command line utility.
Bug Fix: Fixed API so that ssl.cfg is used when using JVM other than that provided by Sun Microsystems.
Release 4.3
Nov. 14, 2008
Enhancement: Added NTLM authentication support.
Change: Renamed example dsa and rsa keys to example_dsa and example_rsa.
Bug Fix: Fixed issue with MD5 and SHA1 hashes generated when using MD5Hasher and SHA1Hasher classes in authentication modules.
Release 4.2
Nov. 7, 2008
Enhancement: Added optional syslog reporting support.
Enhancement: Added js-ipaccess command line utility to manage IP access list.
Enhancement: Increased maximum available retry limits in FTP, FTPS and SFTP file transfer trigger actions from 3 to 9.
Enhancement: Change server behavior so adding or deleting an IP access rule does not require a domain restart.
Enhancement: Added regular expression support for event integer values when creating trigger conditions.
Enhancement: Added ability to set domain administration rights when creating a user template.
Enhancement: Added PAM Authentication module to support authenticating users against native UNIX user databases.
Enhancement: Improved ease of use for entering IP addresses when defining services.
Enhancement: Added ability to automatically unblock an IP address after a certain period of time of being blocked due to too many unsuccessful logins.
Enhancement: Added ability to automatically re-enable an account after a certain period of time of being disabled due to too many unsuccessful logins.
Bug Fix: Fixed trigger timeout issue where if an action ran for more than an hour subsequent actions would not be processed.
Bug Fix: Fixed issue with password policies not being enforced when creating users via web user interface.
Bug Fix: Fixed issue with creating a directory, renaming files or emailing multiple files in HTML user interface when using Windows Vista and IE7.
Bug Fix: Fixed issue in js-adduser command line utility.
Bug Fix: Fixed issue in js-adduserdir command line utility.
Bug Fix: Fixed issue with being unable to download files via HTML user interface that contain special characters.
Bug Fix: Fixed performance issue experienced when assigning accounts to a group.
Bug Fix: In File > Settings > Email panel of JSCAPE MFT Server Java Management API client keys were listed instead of OpenPGP keys.
Bug Fix: Fixed memory issue experienced when adding more than 25 domains.
Release 4.1
Jul. 21, 2008
Chapter 1 Introduction 23
Introduction 1
Enhancement: Updated behavior of ManagerSubsystem.addAccount to throw an exception if the account already exists and added ManagerSubsystem.setAccount method for use in overwriting an existing account.
Enhancement: Updated PGP Encrypt File and PGP Decrypt File actions to allow specifying a destination directory or file.
Enhancement: Added Name property to all Directory Monitor File related events to contain filename.
Enhancement: Added ability to automatically redirect all HTTP requests to HTTPS.
Enhancement: Added default log and datastore directories when creating a domain.
Enhancement: Added js-deldomain command line utility.
Enhancement: Changed default SSH version banner displayed to SFTP clients.
Bug Fix: Fixed issue with automatic startup process on Mac OS X platforms.
Bug Fix: Fixed issue with saving users with all password compliance options enabled.
Bug Fix: Fixed behavior of "Block IP after" option found in Connections node of JSCAPE MFT Server
Manager. Change has been made so that client connection is closed before blocking client IP address.
Bug Fix: Fixed issue with directory listings returned when hosting server on Mac OS X platform.
Bug Fix: Fixed virtual folder permissions issue experienced when multiple virtual folders are assigned to a single user and virtual folders share a common path.
Bug Fix: Fixed issue with clients that request key re-exchange for long SFTP file transfers.
Bug Fix: Fixed issue with being unable to add users or reset passwords when password policies are enabled.
Release 4.0
Jun. 18, 2008
Enhancement: Added ability for users to reset lost password via web interface.
Enhancement: Improved GUI implementation for managing PGP keys.
Enhancement: Added web based account management features allowing user to change their own contact information.
Enhancement: Added ability to assign users limited domain administration capabilities via web interface.
Enhancement: Added support for Linux Z/OS platform.
Enhancement: Added ability to create user templates.
Enhancement: Updated Add Group and Edit Group dialogs to allow for selection of a Reverse Proxy.
Enhancement: Added js-adddomain command line utility to add a domain.
Enhancement: Added js-addserviceftp command line utility to add FTP service.
Enhancement: Added js-addservicesftp command line utility to add SFTP service.
Enhancement: Added js-addservicehttp command line utility to add HTTP and HTTPS services.
Enhancement: Added js-addservicewebdav command line utility to add WebDAV service.
Enhancement: Added js-importusers command line utility to perform bulk import of users from CSV file.
Enhancement: Added js-enablehttp command line utility to enable HTTP service.
Enhancement: Added js-enablehttps command line utility to enable HTTPS service.
Enhancement: Added js-startdomain command line utility to start domain.
Enhancement: Added js-stopdomain command line utility to stop domain.
Change: Renamed Resources node in JSCAPE MFT Server Manager to Reverse Proxies.
Bug Fix: Fixed issue with password compliance settings being applied globally instead of at domain level.
Bug Fix: Fixed issue with not being able to accept HTTP/S connections when running server on Windows
Vista platform.
Bug Fix: Fixed issue with not being able to view reports when running server on Windows Vista platform.
Bug Fix: Fixed issue with SFTP service being unable to accept connections from older SFTP clients that use 1.99 as the software version in SSH client banner.
Bug Fix: Fixed issue with SFTP service being unable to accept uploads for non-existent files using some older SFTP clients.
24 Chapter 1 Introduction
Introduction 1
Release 3.8
Feb. 12, 2008
Enhancement: Added support for IBM JVM 1.4.2 and above.
Enhancement: Added support for AIX 5.x and 6.1 platforms.
Enhancement: Improved auto-start documentation and example SMF script for Solaris platforms.
Enhancement: Added support for ZLIB compression in SFTP protocol.
Enhancement: Added ability to specify send and receive buffer sizes for FTP/S and SFTP protocols.
Enhancement: Added ability to define password policies.
Enhancement: Added several command line utilities for managing users.
Enhancement: Added ability to perform on-demand synchronization of server configuration and account data.
Enhancement: Added atomic file writing support when updating server configuration and account data.
Enhancement: Added support for multiple management connections.
Enhancement: Added ability to limit connections to administrative service based on client IP address.
Bug Fix: Fixed drive sorting bug found in Java applet interface.
Release 3.7
Dec. 28, 2007
Enhancement: Added ability define transfer quotas at the user level.
Enhancement: Added LocalDir event properties to any server events which have LocalPath event property.
Enhancement: Added User Password Changed event to detect when user changes their password.
Enhancement: Added ability to retrieve additional information from database query for use in setting up user in Database Query Authentication module.
Enhancement: Added support for WebDAV resources.
Enhancement: Added ability to run reports using a username filter.
Enhancement: Added ability to define enabled SSL ciphers for FTPS, HTTPS and secure WebDAV services.
Bug Fix: Fixed issue with FTP/S service returning 0 bytes in response to SIZE filename command if file did not exist.
Bug Fix: Changed response code from 151 to 150 for passive data transfers in response to LIST command which caused a problem with some FTP/S clients.
Bug Fix: Fixed issue experienced when uploading large ASCII files.
Bug Fix: Fixed issue with saving settings for LDAP Query Authentication module.
Bug Fix: Fixed memory leak experienced in WebDAV service.
Bug Fix: Fixed SQL and LDAP injection vulnerability found when using Database Query Authentication or
LDAP Query Authentication modules.
Bug Fix: Fixed issue with establishing a data connection to client using different source IP other than that of control channel.
Bug Fix: Fixed issue with encryption keys used in client PGP 6.5.8.
Bug Fix: Fixed issue when uploading large recursive directories using Java applet.
Bug Fix: Fixed table sorting issue in JSCAPE MFT Server Manager.
Bug Fix: Fixed XSS vulnerability.
Bug Fix: Fixed issue with ad-hoc email downloads that only allows downloads that were part of a preauthenticated session.
Bug Fix: Fixed error in Top Hosts reporting metric.
Release 3.6
Nov. 7, 2007
Enhancement: Added ability to create directory on server if it does not exist when creating a virtual path.
25 Chapter 1 Introduction
Introduction 1
Enhancement: Added email address property to user account. This value will be used as the default From address value when using ad-hoc email file transfers.
Enhancement: Moved various properties from WebDAV service to File > Settings > WebDAV in
JSCAPE MFT Server Manager.
Enhancement: Moved various properties from HTTP service to File > Settings > HTTP in JSCAPE
MFT Server Manager.
Enhancement: Added protocol level debugging support to Resources.
Enhancement: Moved virtual paths for user accounts to it's own tab named Paths in Edit user account dialog.
Enhancement: Added time elapsed, time remaining and transfer speed information to progress bar in HTML user interface.
Enhancement: Added wildcard support to LIST, MLST and MLSD command in FTP/S protocols.
Enhancement: Added support for MFMT and MFCT commands in FTP/S protocols.
Enhancement: Various enhancements made to WebDAV Java applet.
Enhancement: Added ability to copy an existing trigger.
Enhancement: Added ability to resume an interrupted transfer in WebDAV Java applet.
Enhancement: Added sorting capabilities to Directory Monitors, Reports, Groups and Resources sections of JSCAPE MFT Server Manager.
Enhancement: Added ability to disable ASCII/Binary option in HTML user interface.
Bug Fix: Fixed hanging progress bar experienced in HTML based user interface if user loses Internet connectivity during file upload. User now receives an error message indicating that the connection was lost.
Bug Fix: Fixed data timeout channel issue experienced during large file transfer when using FTP/S protocols and non-passive connection.
Release 3.5
Oct. 22, 2007
Enhancement: Added ability to define a secondary JSCAPE MFT Server failover server to which all primary server configuration details are synchronized. Failover servers may be chained together to form a cluster.
Enhancement: Added ability to specify directory quotas when using a Directory Monitor.
Enhancement: Added asynchronous logging support to file and database logs.
Enhancement: Added Log Action option to all events that determine whether action success or failure will be logged.
Enhancement: Added optional automatic logout capabilities to HTML user interface which detects long periods of inactivity.
Enhancement: Added ability to disable showing of hotkeys on buttons in HTML user interface.
Enhancement: Added support for importing chained certificates in Key Manager.
Enhancement: Added implicit SSL support to LDAP authentication modules.
Enhancement: Added Second and Millisecond properties to all events.
Enhancement: Added File Upload Started, File Download Started, File Upload Aborted and File Download
Aborted events.
Enhancement: Added list of server network interfaces to Help > About screen.
Enhancement: Added System Configuration Backup action that may be used in a trigger to backup server configuration files.
Bug Fix: Fixed issue with Services node in JSCAPE MFT Server Manager which displayed multiple instances of the same service.
Bug Fix: Fixed issue with displaying JavaHelp contents in environments running Java 1.6.
Bug Fix: Fixed issue with some browsers experienced when using ftp:// style URL to access FTP services.
Release 3.4
Sep. 12, 2007
Enhancement: Added ad-hoc email file transfer support to web interface allowing users to send emails to
26 Chapter 1 Introduction
Introduction 1 an email address along with web based links to selected files.
Enhancement: Added ability to specify text resources and logos independently for each domain.
Enhancement: Added domain level file transfer quotas for a user defined period of time.
Enhancement: Added MODE Z support to FTP/S protocols allowing for ZIP compressed file transfers and directory listings.
Enhancement: Added ability for users to change their account password via the web interface.
Enhancement: Added Trigger Error event that may be used for detecting and responding to failure in a trigger action.
Enhancement: Added "Prompt for password on connect" option to File > Settings > Connection panel which requires that user provide administrative password when launching JSCAPE MFT Server Manager client or when connecting using API.
Bug Fix: Fixed issue in Send Email action where From and To fields were swapped when sending an email.
Bug Fix: Fixed issue with PGP encryption keys where files encrypted using public keys imported from 3rd party PGP clients could not always be decrypted by those PGP clients.
Bug Fix: Fixed issue in 3.3 release where IE displayed error when trying to download files via HTTPS.
Bug Fix: Fixed issue in HTTP and WebDAV services where domain was reported as stopped even though it was running.
Bug Fix: Fixed issue experienced when generating certificate signing requests in Key Manager.
Release 3.3
Jul. 27, 2007
Enhancement: Added ability to generate certificate signing request (CSR) using Key Manager.
Enhancement: Added password hashing support to Database Query Authentication and LDAP Query
Authentication services.
Enhancement: Added ability to forcefully disconnect and optionally disable an active user session/account using Kick User button in Users node.
Enhancement: Added ability for users to change their password using FTP or FTPS protocols.
Enhancement: Added ability to authenticate users using Custom User Authentication API.
Enhancement: Added ability to sort users by name, login or connection status.
Enhancement: Added support for PGP keys in Key Manager.
Enhancement: Added ability to specify SFTP/SSH version information in Services > SFTP panel.
Enhancement: Updated PGP related actions to use keys found in Key Manager.
Enhancement: Removed Send PGP Email action and incorporated PGP email operations into existing
Send Email action.
Enhancement: Removed PGP Sign File action and incorporated file signing into PGP Encrypt File action.
Enhancement: Removed PGP Verify File action and incorporated signature verification into PGP Decrypt
File action.
Enhancement: Added compression and PEM output support to PGP Encrypt File action.
Enhancement: Added requirement to bind public keys to users when using SFTP/SSH protocol combined with public-key authentication.
Bug Fix: Fixed issue in HTML user interface to prevent users from being able to view cached version of directory listing after clicking "Logout".
Bug Fix: Fixed issue experienced in IE7 HTML user interface when clicking on "Add" or "Remove" buttons.
Bug Fix: Fixed issue experienced with setting passive port range.
Release 3.2.5
Jun. 30, 2007
Enhancement: Updated jscape init.d script to support SUSE, Ubuntu and RedHat operating systems.
Bug Fix: Fixed issue experienced with WS_FTP client when using SFTP protocol.
Bug Fix: Fixed potential file corruption issue experienced when uploading file using SFTP protocol.
Bug Fix: Improved FTP/S protocols so that command channel timeout is not observed when client is performing a file transfer.
27 Chapter 1 Introduction
28
Introduction 1
Release 3.2
Jun. 27, 2007
Enhancement: Added "Cancel" button to HTML file transfer user interface allowing users to cancel file uploads.
Enhancement: Updated Java Applet to include graphical buttons for performing basic actions such as
Rename, Delete, Create Directory etc.
Enhancement: Updated HTML user interface to display file sizes in more user friendly format.
Enhancement: Added customizable "Add" and "Remove" text next to add and remove buttons in HTML user interface.
Enhancement: Added customizable "Logged in as" text to web user interface.
Bug Fix: Fixed issue with renaming files in HTML user interface when using IE.
Bug Fix: Fixed issue with multiple domains using database resources.
Bug Fix: Fixed issue where editing an action in a trigger could cause improper re-ordering of actions.
Release 3.1
May 27, 2007
Enhancement: Added support for WebDAV service.
Enhancement: Added Java applet client to web interface.
Enhancement: Updated look and feel of HTML based user interface.
Enhancement: Added Directory Monitors feature to monitor one or more local directories for changes.
Enhancement: Updated authentication panels in JSCAPE MFT Server Manager to give user more flexibility in specifying default login directory.
Enhancement: Added support for AES and other ciphers to SFTP protocol.
Enhancement: Added ability to specify Logout URL for HTTP services at domain level.
Enhancement: Added several new trigger event variables for capturing date/time and domain name.
Enhancement: Added a new Run Process action that can be used in a trigger to execute local processes.
Enhancement: Updated Delete Directory action, adding ability to specify that only files older than a certain age be deleted.
Enhancement: Improved performance for file uploads.
Enhancement: Added source-code API examples to the api-examples directory of JSCAPE MFT Server installation directory.
Enhancement: Added more text properties to File > Settings > Web > Resource panel.
Change: Changed license key format.
Bug Fix: Fixed issue with SFTP clients connecting using unsupported protocol version.
Bug Fix: Fixed issue with importing SSH keys generated using ssh-keygen command.
Bug Fix: Fixed issue with virtual directories containing invalid characters such as * and ?.
Release 3.0
April 9, 2007
Enhancement: Added support for SFTP (FTP over SSH) service.
Enhancement: Added support for client SSL certificates for use in FTPS (FTP over SSL) services.
Enhancement: Added DMZ support using Resources.
Enhancement: Added Directory Download Synchronization action. This action allows users to synchronize local directories with remote FTP/FTPS/SFTP resources.
Enhancement: Added Directory Upload Synchronization action. This action allows users to synchronize remote FTP/FTPS/SFTP resources with a local directory.
Enhancement: Added Ftp Delete Directory and Ftp Delete File actions for deleting directories and files on remote FTP servers.
Enhancement: Added Ftps Delete Directory and Ftps Delete File actions for deleting directories and files on remote FTP servers using FTPS (FTP over SSL).
Enhancement: Added Sftp Delete Directory and Sftp Delete File actions for deleting directories and files on
Chapter 1 Introduction
Introduction 1 remote SSH servers using SFTP (FTP over SSH).
Enhancement: Added Ftp Regex File Upload and Ftp Regex File Download actions for transferring files to/ from FTP server using a regular expression.
Enhancement: Added Ftps Regex File Upload and Ftps Regex File Download actions for transferring files to/from FTP server using a regular expression and FTPS (FTP over SSL).
Enhancement: Added Sftp Regex File Upload and Sftp Regex File Download actions for transferring files to/ from SSH server using a regular expression and SFTP (FTP over SSH).
Enhancement: Added Send PGP Email action for sending OpenPGP encrypted email messages.
Enhancement: Added Zip Directory action for compressing the contents of a directory into a zip archive.
Enhancement: Added Run Report action for re-running an existing report.
Enhancement: Modified Check Email action to automatically verify/decrypt OpenPGP encrypted email messages.
Enhancement: Updated Copy Directory action allowing users to specify the level of copy performed.
Enhancement: Updated Delete Directory action allowing users to specify the level of delete performed.
Enhancement: Updated Send Email action allowing for sending of email using secure SSL encrypted connection.
Enhancement: Updated Send Email action to include optional receipt notification upon recipient opening email message.
Enhancement: Changed Add Domain process so that services are automatically started after adding a domain.
Enhancement: Changed File > Settings > Connection panel so connection is automatically established upon changing connection parameters.
Enhancement: Improved database reports allowing users to specify a Start Date and End Date range.
Enhancement: Added variable support to Authentication panel where appropriate.
Enhancement: Improved date validation components in manager GUI.
Enhancement: Added External File Upload and External File Download event types to monitor outbound and inbound file transfers made using triggers/actions.
Enhancement: Added events to capture administrative actions including Group Deleted, Group Updated, IP
Access Rules Updated, Resource Deleted, Resource Updated, User Deleted, User Updated.
Enhancement: Improved formatting in reports.
Enhancement: Added additional metrics to reports including Top External Uploads, Top External
Downloads, Top Email Attachments Sent and Top Email Attachments Received.
Enhancement: Changed command channel timeout for FTP services to automatically detect activity on data channel.
Enhancement: Added verbose logging support for all services.
Enhancement: Added automatic login support to Web services using URL parameters.
Enhancement: Added support for optionally redirecting user to a different URL in Web service when clicking
Logout button.
Enhancement: Added true regular expression support to File Transfer Script action.
Bug Fix: Fixed issue in Convert File action.
Bug Fix: Fixed timestamp issue encountered when using database logging.
Bug Fix: Fixed memory issue experienced when trying to view large log record sets stored in relational database.
Bug Fix: Fixed issue experience when using multiple JDBC drivers simultaneously.
Release 2.1
December 13, 2006
Enhancement: Added authentication module for authenticating users against relational databases, LDAP or
Active Directory services.
Enhancement: Added ability to schedule one-time-only or recurring actions using Current Time event and triggers.
Enhancement: Added ability to store activity logs in a relational database.
Enhancement: Added checkpoint restart and checksum verification to file transfer actions.
Enhancement: Added ability to specify up to three attachments in Send Email action.
29 Chapter 1 Introduction
Introduction 1
Enhancement: Improved GUI screens in triggers section used in obtaining action variables.
Enhancement: Improved API for defining custom actions allowing you to specify the type of GUI components used when accepting input.
Enhancement: Added File Transfer Script action which consists of an easy-to-use file transfer scripting language that may be used in triggers.
Enhancement: Added Check Email action which checks for email against a POP or IMAP account, stores original message to a directory and extracts any attachments from message and stores these to a separate directory.
Enhancement: No longer necessary to specify driver class for JDBC database drivers.
Enhancement: Added debug logging support to network related actions such as Send Email, Ftp File
Upload, Sftp File Upload etc.
Bug Fix: Fixed JSCAPE MFT Server Web Gateway compatibility issues with IE 5.2 and Safari browsers in
Mac OS X.
Release 2.0
November 2, 2006
Enhancement: Added support for triggers and over 30 different actions.
Enhancement: Added reporting module to report on log data.
Enhancement: Added ability to add remote FTP resources and map those resources to virtual paths.
Enhancement: Added ability to import existing keys stored in PKCS#12 files.
Release 1.2
August 16, 2006
Enhancement: Added JSCAPE MFT Server Web Gateway component to accept web based FTP connections.
Enhancement: Added JavaHelp to JSCAPE MFT Server Manager.
Enhancement: Added service configuration script to be placed in /etc/init.d directory of UNIX environments to assist in auto-starting.
Enhancement: Changed logging format to use W3C for improved reporting capabilities.
Enhancement: Added ability to specify log rotation period.
Enhancement: Changed data serialization method used.
Enhancement: Added keyboard mnemonics to JSCAPE MFT Server Manager.
Enhancement: Updated JSCAPE MFT Server Manager so it is no longer necessary to manually stop server prior to applying changes.
Release 1.1
June 22, 2006
Minor bug fixes
Release 1.0
June 15, 2006
Initial production release.
30
Software components
JSCAPE MFT Server consists of two installable components which are JSCAPE MFT Server and JSCAPE
MFT Server Manager. These components are described in more detail below.
JSCAPE MFT Server
Chapter 1 Introduction
Installation 2
This component is required and is typically installed on one or more servers to provide managed file transfer services.
JSCAPE MFT Server Manager
This component is optional and is typically installed only when you are using the JSCAPE MFT Server Java
Management API. If you are not using the JSCAPE MFT Server Java Management API then this component is not necessary as all management may be performed via the web based administrative interface.
Installing on Windows
To install JSCAPE MFT Server on a Windows platform perform the following:
1. Download and run the install.exe installation file for JSCAPE MFT Server. Click Next to continue.
Figure 173
2. Read and accept license agreement. Click Next to continue.
Figure 174
Chapter 2 Installation 31
Installation 2
3. Select installation directory. Click Next to continue.
Figure 175
4. Select components to be installed. See
for details. Click Next to continue.
Figure 176
32 Chapter 2 Installation
Installation 2
5. Enter name of Start Menu Folder. Click Next to continue.
Figure 177
6. Configure management/REST services and administrative credentials.
Chapter 2 Installation 33
Installation
Figure 178
2
Management host/IP - The IP address that management service should listen on. The IP address
0.0.0.0
is a special address that instructs service to listen on all available network interfaces.
Management port - The port that management service should listen on. Default port is 10880.
REST HTTP host/IP - The IP address that REST web service should listen on. The IP address 0.0.0.0
is a special address that instructs service to listen on all available network interfaces.
REST HTTP port - The port that REST web service should listen on. Default port is 11880.
Username - Administrative username for managing services.
Password - Administrative password for managing services.
7. Set allocated application memory. Minimum allocated memory is 512MB with recommended value of
1024MB or more.
Figure 179
34 Chapter 2 Installation
Installation 2
8. Launch JSCAPE MFT Server Manager to configure your server.
Figure 180
9. If you are running any firewall software make sure that it is setup to allow JSCAPE MFT Server to run.
For firewalls that use application whitelisting, add the application server.exe located in the JSCAPE
MFT Server installation directory.
Chapter 2 Installation 35
Installation
See also
Server configuration > Launching the administrative client
2
Installing on Linux
RPM Console Installation
To install using the RPM file perform the following steps as a user with root privileges.
1. Place the install.rpm file in a directory on the destination server.
2. Install. Run the following command from the directory containing the RPM file you placed on your server: rpm -iv install.rpm
3. Configure Administration Service. Go to the /opt/JSCAPE_MFT_Server directory and run the following command:
./server-configuration -host [ip address] -port [port] -rest.host [ip address] -rest.port [rest.port] -user [username] -password [password]
For example:
./server-configuration -host 0.0.0.0 -port 10880 -rest.host 0.0.0.0 rest.port 11880 -user admin -password secret
This will configure your JSCAPE MFT Server Service , where [ip address] and [port] are the IP/port that you want the JSCAPE MFT Server Service to listen on, [rest.port] is the port that you want the
REST web service to listen on, and [username] [password] are the credentials you will use when connecting to the service. This service is what you will connect to using the JSCAPE MFT Server Manager to manage your server. Defaults ports for JSCAPE MFT Server Service and REST web service are 10880 and 11880 respectively.
Note, the IP address 0.0.0.0 is a special address that instructs the service to listen on all available network interfaces.
4. Startup Administration Service. From the /opt/JSCAPE_MFT_Server directory run the following command:
./start_service.sh
The JSCAPE MFT Server Service should now be running. To connect to this service and manage your server see the following topics:
Server configuration > Launching the administrative client
Auto-starting in UNIX environments
36 Chapter 2 Installation
Installation 2
ZIP Console Installation
1. Place the install.zip file in a directory on the destination server.
2. Install. Run the following command from the directory containing the ZIP file you placed on your server: unzip install.zip
3. Configure Administration Service. Go to the JSCAPE MFT Server installation directory, located in the
JSCAPE_MFT_Server directory relative to where the unzip command was executed, and run the following command:
./server-configuration -host [ip address] -port [port] -rest.host [ip address] -rest.port [rest.port] -user [username] -password [password]
For example:
./server-configuration -host 0.0.0.0 -port 10880 -rest.host 0.0.0.0 rest.port 11880 -user admin -password secret
This will configure your JSCAPE MFT Server Service , where [ip address] and [port] are the IP/port that you want the JSCAPE MFT Server Service to listen on, [rest.port] is the port that you want the
REST web service to listen on, and [username] [password] are the credentials you will use when connecting to the service. This service is what you will connect to using the JSCAPE MFT Server Manager to manage your server. Defaults ports for JSCAPE MFT Server Service and REST web service are 10880 and 11880 respectively.
Note, the IP address 0.0.0.0 is a special address that instructs the service to listen on all available network interfaces.
4. Startup JSCAPE MFT Server Service. From the JSCAPE MFT Server installation directory run the following command:
./start_service.sh
The JSCAPE MFT Server Service should now be running. To connect to this service and manage your server see the following topics:
Server configuration > Launching the administrative client
Auto-starting in UNIX environments
Installing on Linux Z/OS
See also
37 Chapter 2 Installation
Installation 2
Installing on Solaris
ZIP Console Installation
To install using the ZIP file perform the following steps as a user with root privileges. If you plan on running
JSCAPE MFT Server as a non-root user under Solaris 10 or above, please consult the topic
Solaris 10 environments topic before continuing.
1. Place the install.zip file in a directory on the destination server.
2. Install. Run the following command from the directory containing the ZIP file you placed on your server: unzip install.zip
3. Configure Administration Service. Go to the JSCAPE MFT Server installation directory, located in the
JSCAPE_MFT_Server directory relative to where the unzip command was executed, and run the following command:
./server-configuration -host [ip address] -port [port] -rest.host [ip address] -rest.port [rest.port] -user [username] -password [password]
For example:
./server-configuration -host 0.0.0.0 -port 10880 -rest.host 0.0.0.0 rest.port 11880 -user admin -password secret
This will configure your JSCAPE MFT Server Service , where [ip address] and [port] are the IP/port that you want the JSCAPE MFT Server Service to listen on, [rest.port] is the port that you want the
REST web service to listen on, and [username] [password] are the credentials you will use when connecting to the service. This service is what you will connect to using the JSCAPE MFT Server Manager to manage your server. Defaults ports for JSCAPE MFT Server Service and REST web service are 10880 and 11880 respectively.
Note, the IP address 0.0.0.0 is a special address that instructs the service to listen on all available network interfaces.
4. Startup JSCAPE MFT Server Service. If you are auto-starting using an SMF script you may skip this step. From the JSCAPE MFT Server installation directory run the following command:
./start_service.sh
The JSCAPE MFT Server Service should now be running. To connect to this service and manage your server see the following topics:
Server configuration > Launching the administrative client
Auto-starting in Solaris 10 environments
Auto-starting in UNIX environments
38 Chapter 2 Installation
Installation 2
Installing on AIX
ZIP Console Installation
To install using the ZIP file perform the following steps as a user with root privileges.
1. Place the install.zip file in a directory on the destination server.
2. Install. Run the following command from the directory containing the ZIP file you placed on your server: unzip install.zip
3. Configure Administration Service. Go to the JSCAPE MFT Server installation directory, located in the
JSCAPE_MFT_Server directory relative to where the unzip command was executed, and run the following command:
./server-configuration -host [ip address] -port [port] -rest.host [ip address] -rest.port [rest.port] -user [username] -password [password]
For example:
./server-configuration -host 0.0.0.0 -port 10880 -rest.host 0.0.0.0 rest.port 11880 -user admin -password secret
This will configure your JSCAPE MFT Server Service , where [ip address] and [port] are the IP/port that you want the JSCAPE MFT Server Service to listen on, [rest.port] is the port that you want the
REST web service to listen on, and [username] [password] are the credentials you will use when connecting to the service. This service is what you will connect to using the JSCAPE MFT Server Manager to manage your server. Defaults ports for JSCAPE MFT Server Service and REST web service are 10880 and 11880 respectively.
Note, the IP address 0.0.0.0 is a special address that instructs the service to listen on all available network interfaces.
4. AIX systems are typically configured to run the IBM JVM, therefore it is necessary to make some changes to various configuration files in order to instruct the JVM on what security provider and encryption algorithm to use for starting up the JSCAPE MFT Server Service.
See
for complete details and instructions.
5. Startup JSCAPE MFT Server Service. From the JSCAPE MFT Server installation directory run the following command:
./start_service.sh
The JSCAPE MFT Server Service should now be running. To connect to this service and manage your server see the following topics:
Server configuration > Launching the administrative client
Auto-starting in UNIX environments
39 Chapter 2 Installation
Installation 2
Installing on Mac OS X
To install JSCAPE MFT Server on a Windows platform perform the following:
1. Download and run the install.dmg installation file for JSCAPE MFT Server. Click Next to continue.
Figure 181
2. Read and accept license agreement. Click Next to continue.
Figure 182
40 Chapter 2 Installation
Installation 2
3. Select installation directory. Click Next to continue.
Figure 183
4. Select components to be installed. See
for details. Click Next to continue.
Chapter 2 Installation 41
Installation
Figure 184
2
5. Configure management/REST services and administrative credentials.
Figure 185
42 Chapter 2 Installation
Installation 2
Management host/IP - The IP address that management service should listen on. The IP address
0.0.0.0
is a special address that instructs service to listen on all available network interfaces.
Management port - The port that management service should listen on. Default port is 10880.
REST HTTP host/IP - The IP address that REST web service should listen on. The IP address 0.0.0.0
is a special address that instructs service to listen on all available network interfaces.
REST HTTP port - The port that REST web service should listen on. Default port is 11880.
Username - Administrative username for managing services.
Password - Administrative password for managing services.
6. Set allocated application memory. Minimum allocated memory is 512MB with recommended value of
1024MB or more for servers under heavy load.
Figure 186
Chapter 2 Installation 43
Installation 2
7. Launch JSCAPE MFT Server Manager to configure your server.
Figure 187
44 Chapter 2 Installation
Installation 2
8. Start the JSCAPE MFT Server Service. Service will start automatically following installation. If service is not started then you may start it manually as root user using the ./start_service.sh command from a terminal shell prompt.
In order to have service start automatically upon system reboot edit the /Library/LaunchDaemons/ com.jscape.MFTServer.plist
file and set the value for the OnDemand parameter to false.
9. Verify that JSCAPE MFT Server Service is running using the following commands from your shell prompt: netstat -a | grep 10880 netstat -a | grep 11880 where 10880 is the listening port for JSCAPE MFT Server Service, and 11880 is listening port for REST web service.
See also
Server configuration > Launching the administrative client
Chapter 2 Installation 45
Installation 2
Auto-starting in Linux and Solaris 9 environments
For Linux and Solaris 9 environments you may have JSCAPE MFT Server Service start up automatically during system startup by creating a service configuration file for JSCAPE MFT Server Service and placing it in your /etc/init.d directory. This same configuration file will be used for gracefully stopping the
JSCAPE MFT Server Service when shutting down the system. A sample service configuration file, jscape , has been placed in the init.d directory of your JSCAPE MFT Server installation.
Installing the service configuration file
1. As root user, copy the jscape sample service configuration file to your /etc/init.d directory.
2. Grant execute permissions to this file using the command chmod 755 jscape
3. Using a text editor, change the value of the INSTALL_DIR variable to the absolute path of your
JSCAPE MFT Server installation directory. The default value for the INSTALL_DIR variable is /opt/
JSCAPE_MFT_Server which is consistent with Linux RPM installations. Your installation directory may vary.
4. Set this script to be executed automatically upon system startup using the following command(s):
Linux
/sbin/chkconfig --add jscape
Solaris 9 ln /etc/init.d/jcsape /etc/rc3.d/Sxxjscape ln /etc/init.d/jcsape /etc/rc0.d/Kxxjscape
Note
If you are running under Ubuntu environment then the chkconfig command is not available. Instead you must run the following command as root user from /etc/init.d directory.
update-rc.d jscape defaults
Starting the service
From the /etc/init.d directory and as root user run the command ./jscape start to start the service.
Stopping the service
From the /etc/init.d directory and as root user run the command ./jscape stop to stop the service.
Restarting the service
From the /etc/init.d directory and as root user run the command ./jscape restart to restart
46 Chapter 2 Installation
Installation the service.
2
See also
Running as non-root user in UNIX environments
Auto-starting in Solaris 10 environments
Solaris 10 uses SMF (Service Management Facility) for creating and managing services. To enable
JSCAPE MFT Server as a service perform the following.
1. As root user, create a user and group named jscape.
2. As root user, run the command usermod -K defaultpriv=basic,net_privaddr jscape to grant jscape user permissions to run services on ports less than 1024.
3. As jscape user, run installer for Solaris as described in
4. Open the sample SMF manifest file jscape_smf.xml found in the JSCAPE MFT Server installation directory using vi or other text editor.
5. Change references to /opt/JSCAPE_MFT_Server with the absolute path of JSCAPE MFT Server installation directory.
6. As root user, validate SMF manifest file using svccfg validate jscape_smf.xml command.
7. As root user, import SMF manifest file using svccfg import jscape_smf.xml command.
8. As root user, Check for default Solaris FTP service using command netstat -na | grep 21 If you wish to disable this service you may do so using svcadmin disable ftp:default command.
9. As root user, enable service using svcadm enable svc:/application/jscape:default command.
10.Check that service was started successfully and not in maintenance using svcs -x jscape: default command.
11.Verify that JSCAPE MFT Server Service is running using netstat -na | grep 10880 command.
For more information on creating services using SMF please see the following links: http://www.sun.com/software/solaris/howtoguides/smfmanifesthowto.jsp
http://www.sun.com/software/solaris/howtoguides/servicemgmthowto.jsp
Running as non-root user in UNIX environments
Solaris 10 and above systems
If you are running under Solaris 10 or above then you may run as non-root using the provided example SMF script. Please see the following topic for details.
Auto-starting in Solaris 10 environments
Solaris 9 and Linux/UNIX systems
The simplest method for installing and running JSCAPE MFT Server is to do so as the root user.
However in some UNIX based environments you may want or need to run JSCAPE MFT Server as a user other than root. Should you decide to go this route there are certain issues to consider when installing and configuring JSCAPE MFT Server.
47 Chapter 2 Installation
Installation 2
Filesystem permissions
When running JSCAPE MFT Server as a non-root system user ensure that this user has user or group level permissions granting them full access to the virtual directories that you define for your JSCAPE MFT Server users. Additionally this user should be granted full access to the JSCAPE MFT Server installation directory, logging directory, user datastore directory and all supporting files within these directories.
Port redirection
As a general rule, UNIX based (Linux, Solaris, Mac OS X) programs that bind to ports less than 1024 must be run as root user. For example, the standard port for ftp is port 21 requiring that you run JSCAPE MFT
Server as root user in order to bind and listen on this port for incoming requests. One solution that gets you around this restriction is to have your server run on ports > 1024. For example, you might set your ftp service to run on port 2121 instead of port 21 in order to be able to run JSCAPE MFT Server as a non-root user. There may however be a case where you want to be able to run JSCAPE MFT Server as a non-root user while also using ports less than 1024. The two methods available are Port redirection using xinetd and Port redirection using iptables which are discussed below.
Port redirection using xinetd
The xinetd Internet service daemon is installed on most UNIX based systems and offers a feature that allows for port redirection. Using this port redirection feature you could for example redirect incoming requests on port 21 to port 2121 thus allowing you to run your ftp service as a non-root user on port 2121 while still being able to accept redirected requests from port 21. To setup xinetd to perform this redirection go to your /etc/xinetd.d directory and create a new service configuration file named jscape (as root user) the contents of which are displayed below.
# Redirects any requests on port 21
# to port 2121 (where JSCAPE MFT Server is listening) service jscape
{
socket_type
protocol = tcp
user
wait
= stream
port = 21
redirect = localhost 2121
disable
}
= no
= root
= no
Next you will need to restart the xinetd service to load this service. On most UNIX based systems this can be done by issuing the following command.
/sbin/service xinetd restart
You will now be able to accept requests on port 21 which are then redirected to your listening port of 2121.
By leaving the jscape service configuration file in the /etc/xinetd.d directory this redirection will automatically take place whenever you restart your system.
Port redirection using iptables
A solution available in systems running Linux kernel 2.4 and above is to use iptables. iptables offers the same approach as xinetd but with less process overhead since iptables is compiled into the kernel rather
48 Chapter 2 Installation
Installation than running as a separate process. To see if iptables is running on your system run the following command as root user.
2
/sbin/service iptables status
If it is running you will see a list of tables displayed to the console.
Using our original example, create a new redirection rule that will redirect incoming requests on port 21 to port 2121 by issuing the following command as root user.
/sbin/iptables -t nat -A PREROUTING -j REDIRECT -p tcp --destination-port
21:21 --to-ports 2121
This will redirect port requests until you restart your system. To ensure that this rule is used after a system restart save the rule by issuing the following command as root user.
/sbin/service iptables save
See also
Auto-starting in UNIX environments
Running under IBM JVM
For systems configured to run using the IBM JVM it is necessary to make some changes to various configuration files in order to instruct the JVM on what security provider and encryption algorithm to use for starting up the JSCAPE MFT Server Service. Using a text editor, update the following files relative to the installation directory as follows.
ssl.cfg
algorithm=IbmX509 provider=IBMJSSE2 webapp/filetransfer/META-INF/Owasp.CsrfGuard.properties
org.owasp.csrfguard.PRNG=IBMSecureRandom org.owasp.csrfguard.PRNG.Provider=IBMJCE webapp/management/META-INF/Owasp.CsrfGuard.properties
org.owasp.csrfguard.PRNG=IBMSecureRandom org.owasp.csrfguard.PRNG.Provider=IBMJCE
Upon saving changes to these files restart the JSCAPE MFT Server Service so the changes may take effect.
Additional libraries needed for OpenPGP
If you are planning to use the OpenPGP features that are included as part of JSCAPE MFT Server, then you may need to install the JCE Unlimited Strength Jurisdiction Policy Files distributed by Oracle.
OpenPGP features may work without this process, but only for PGP keys of limited strengths.
Due to export restriction the version of the policy files bundled by default with the JDK allow "strong" but
Chapter 2 Installation 49
Installation limited cryptography to be used. The "unlimited strength" policy files contain no restrictions on the cryptographic strengths.
2
Download Unlimited Strength Jurisdiction Policy Files http://www.oracle.com/technetwork/java/javase/downloads/jce-6-download-429243.html
(JVM 1.6) http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html
(JVM 1.7) http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html
(JVM 1.8)
Installation
1. Determine the location of the JVM/JDK you are using by opening the .install4j\inst_jre.cfg
file located in your JSCAPE MFT Server installation directory. This file will contain the path to the JRE used when running JSCAPE MFT Server.
Example c:\program files\java\jre
2. Extract the contents of the Unlimited Strength Jurisdiction Policy Files to a temporary directory.
3. Copy the local_policy.jar and US_export_policy.jar files extracted in the previous step to the lib\security directory of your JRE making sure to backup previous versions of these jar files should you decide to revert back to the previous installation.
Example c:\program files\java\jre\lib\security
4. Restart both the JSCAPE MFT Server Service and JSCAPE MFT Server Manager.
50
Additional libraries needed for SFTP ciphers
If you are planning to use the non-default ciphers that are included as part of JSCAPE MFT Server SFTP service, then you may need to install the JCE Unlimited Strength Jurisdiction Policy Files distributed by
Oracle.
The default ciphers that are supported by the SFTP service include blowfish-cbc, 3des-cbc, none. If you are only using the default enabled ciphers then installing the Unlimited Strength Jurisdiction Policy Files is not necessary.
Examples of non-default ciphers that require installing the Unlimited Strength Jurisdiction Policy Files include but are not limited to aes, twofish, serpent, idea and cast.
Due to export restriction the version of the policy files bundled by default with the JDK allow "strong" but limited cryptography to be used. The "unlimited strength" policy files contain no restrictions on the cryptographic strengths.
Chapter 2 Installation
Installation 2
Download Unlimited Strength Jurisdiction Policy Files http://www.oracle.com/technetwork/java/javase/downloads/jce-6-download-429243.html
(JVM 1.6) http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html
(JVM 1.7) http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html
(JVM 1.8)
Installation
1. Determine the location of the JVM/JDK you are using by opening the .install4j\inst_jre.cfg
file located in your JSCAPE MFT Server installation directory. This file will contain the path to the JRE used when running JSCAPE MFT Server.
Example c:\program files\java\jre
2. Extract the contents of the Unlimited Strength Jurisdiction Policy Files to a temporary directory.
3. Copy the local_policy.jar and US_export_policy.jar files extracted in the previous step to the lib\security directory of your JRE making sure to backup previous versions of these jar files should you decide to revert back to the previous installation.
Example c:\program files\java\jre\lib\security
4. Restart both the JSCAPE MFT Server Service and JSCAPE MFT Server Manager.
Starting the JSCAPE MFT Server Service
In order to manage the JSCAPE MFT Server you must first start the JSCAPE MFT Server Service. This service allows you to manage the JSCAPE MFT Server using JSCAPE MFT Server Manager.
Windows
You may start the service by going to your Control Panel > Administrative Tools >
Services and starting the JSCAPE MFT Server service. Alternatively you may start the service from the
JSCAPE MFT Server program group by clicking on Administrative Tools > Start Service.
Linux / UNIX / Mac OS X
Go to the JSCAPE MFT Server installation directory. For Linux RPM installations this is /opt/
JSCAPE_MFT_Server . For UNIX and non-RPM Linux installations this is the directory that you selected during installation. To start the JSCAPE MFT Server Service run the following command as a user with
Chapter 2 Installation 51
Server configuration super-user privileges:
./start_service.sh
3
Launching the JSCAPE MFT Server Manager
Windows
The JSCAPE MFT Server Manager is a web based application which may be used to manage your instance of JSCAPE MFT Server. You may start JSCAPE MFT Server Manager by pointing your web browser to http://[hostname]:[port] where [hostname] is the IP address or hostname and
[port] is the listening port of the REST management web service defined during the installation process.
The default port is 11880.
e.g. http://127.0.0.1:11880
Upon successfully connecting to REST management service, you will be prompted for an administrative username and password to login. These credentials are those that you defined during the installation process.
Figure 172
52 Chapter 3 Server configuration
Figure 1
Server configuration 3
See also
Creating a domain
You may create a domain using the JSCAPE MFT Server Manager.
Step 1
Using JSCAPE MFT Server Manager select Server > New Domain... from the main menu. The New
Domain wizard is displayed. This wizard allows you to quickly create a new domain with one service and minimum settings. You may later customize the domain to meet your needs by selecting the domain from the Domains tab and clicking Edit button.
Figure 2
Chapter 3 Server configuration 53
Server configuration 3
Name - A unique name you wish to give this domain. Make sure to choose the name carefully as it may not be changed once created.
Description - A description of this domain.
Step 2
Figure 3
Protocol - The service type to add. FTP/S, SFTP/SCP, HTTP/S, AS2, AFTP and WebDAV/S protocols are available.
54 Chapter 3 Server configuration
Server configuration 3
Host - The IP address that this service will listen on.
Port - The port that this service will listen on.
Private key - The private key that this service will use for encrypting communications. Available only when adding FTP/S, SFTP/SCP and AFTP services.
Step 3
Figure 4
Store data to - The type of datastore (file per record, file or database) to use for storing user account and group data.
Directory - The directory to store user account data and group data. (file per record or file)
Step 4
Figure 5
Chapter 3 Server configuration 55
Server configuration 3
Log to - file to log activity to a directory or database to log activity to a JDBC accessible database.
Directory - The directory where to store log files. (file log)
File rotation - The frequency in which to rotate log files. (file log)
Starting a domain
Using JSCAPE MFT Server Manager select the domain you wish to start and click the Start button located in the lower left of your screen.
Figure 6
56 Chapter 3 Server configuration
Server configuration 3
Stopping a domain
Using the JSCAPE MFT Server Manager select the domain you wish to stop and click the Stop button located in the lower left of your screen.
Figure 133
Viewing domain status
Using the JSCAPE MFT Server Manager select the domain you wish to view status for. Each column for the selected domain provides information on it's status. For additional information you may click the
Status button.
Figure 133
Chapter 3 Server configuration 57
Server configuration 3
State - Indicates current status of domain as running or stopped.
Current Connections - The current number of client sessions connected to domain.
Current Transfers - The current number of file transfers in progress.
Total Connections - The total number of client sessions since start date.
Uploaded - The total number of bytes uploaded since start date.
Uploaded Files - The total number of files uploaded since start date.
Downloaded - The total number of bytes downloaded since start date.
Downloaded Files - The total number of files downloaded since start date.
Uploads Quota - The current upload quota if upload quota is enabled.
Downloads Quota - The current download quota if download quota is enabled.
Transfers Quota - The current transfer quota if transfer quota is enabled.
Start Date - The date/time server was started.
Stop Date - The date/time server was stopped.
Adding services
A service is an IP/Host, Port and Protocol combination that accepts client requests. To view existing services for a domain, select the desired domain and click the Edit button. Next, select the Services node. A list of services for the domain are displayed.
Figure 9
Protocol - The service protocol. Available protocols are AFTP, AS2, FTP/S, HTTP/S, OFTP, SFTP/SCP,
TFTP, WebDAV/S.
58 Chapter 3 Server configuration
Server configuration
Host/IP - The IP address that this service will listen on.
Port - The port that this service will listen on.
Key - The private encryption key that this service will use for encrypted communications.
Details - Any additional details for this service.
Service types
AFTP - Accelerated File Transfer Protocol developed by JSCAPE. Runs on top of UDP protocol and provides fast file transfers over networks with high latency and/or packet loss characteristics.
AS2 - Accepts incoming AS2 messages.
FTP regular - Accepts standard unencrypted FTP connections.
3
FTP explicit SSL - Accepts both standard unencrypted FTP connections and encrypted explicit SSL connections using AUTH TLS or AUTH SSL client commands.
FTP forced explicit SSL - Accepts only encrypted explicit SSL connections using AUTH TLS or AUTH SSL client commands.
FTP implicit SSL - Accepts only encrypted implicit SSL connections.
HTTP/S - Accepts HTTP and/or encrypted HTTPS connections.
OFTP - Accepts incoming OFTP (Odette File Transfer Protocol) connections.
SFTP/SCP - Accepts encrypted SFTP (FTP over SSH) connections and SCP (Secure Copy)
TFTP - Accepts TFTP (Trivial File Transfer Protocol) connections.
WebDAV/S - Accepts WebDAV connections.
Add service
Figure 10
59 Chapter 3 Server configuration
Server configuration 3
Protocol - The service protocol. Available protocols are AFTP, AS2, FTP/S, HTTP/S, OFTP, SFTP/SCP,
TFTP, WebDAV/S.
Host - The IP address that this service will listen on.
Port - The port that this service will listen on.
Type - The protocol(s) that this service will accept connections for. (FTP)
Private key - The private encryption key that this service will use for encrypted communications.
Delete service
To delete a service select the service you wish to delete and click the "Delete" button.
Setting SFTP/SSH authentication mode
The SFTP/SCP service supports various forms of user authentication. These include password, publickey , password OR publickey and password AND public key.
Figure 76
60 Chapter 3 Server configuration
Server configuration 3
Host/IP - The IP address that this service will listen on.
Port - The port that this service will listen on.
Private key - The encryption key that this server will use for SSH communications.
Authentication - The authentication mode clients must use when connecting to SFTP/SCP service.
Authentication modes password - User must authentication with password only.
publickey - User must authentication with a private key that corresponds with public key installed on server.
password OR publickey - User must authenticate with password OR with a private key that corresponds with public key installed on server.
password AND publickey - User must authenticate with password AND with a private key that corresponds with public key installed on server.
See also
Using public key authentication in SFTP/SSH
Chapter 3 Server configuration 61
Server configuration 3
Using public key authentication in SFTP/SSH
The SFTP/SCP service supports public key authentication. In public key authentication the client authenticates with the server using a username and private key (optionally password protected) accessible only the the user. For increased security the SFTP/SCP service may be configured to require both a private key and the account password. In order to use public key authentication the SFTP/SCP service must be configured properly (See
Setting SFTP/SSH authentication mode ) and a public key must be
associated with the user.
To associate a public key with a user you may store the key in the centralized Key Manager, or you can allow the user to manage their own key (See
Web user interface for details). To create a key using the
Key Manager follow the steps below.
Create a client key
1. Go to Server > Key Manager > Client Keys panel and click on the Generate button to create a new client key. When prompted for an Key alias it is recommended you enter the username that you would like to associate this key with. For the Type and Length fields you may leave these as the default values or select from options provided. Click OK to continue.
Figure 75
62
2. Next you will need to export the private key. This is the key you will use in your SFTP/SCP client for authenticating with the SFTP/SCP service. When exporting private key select the PEM file type format.
Click OK to export your private key and add client key to the client keys listing.
Chapter 3 Server configuration
Server configuration
Figure 103
3
3. The next step is to bind this client key to the user. This allows this client key to be used by this user for authentication purposes. Go to the Users node, select the user for this key and click Edit button. In the Client keys section check the client key that you created earlier and click OK.
Figure 105
Chapter 3 Server configuration 63
Server configuration 3
4. Next you must add the SFTP/SCP service with the option to allow authentication using public keys. If you have already done this then you may skip this step. Otherwise, go to the Services node, select the
Add button and select the SFTP/SCP protocol. Set the Authentication option for service to use one of the publickey options. Click OK.
5. You have successfully enabled public key authentication for the SFTP/SCP service. To authenticate, instruct your SFTP/SCP client to use the private key you exported in Step 2. Some SFTP/SCP clients, e.g. Putty, use a proprietary private key format. Therefore it may be necessary that you convert the PEM formatted key to the client proprietary key format prior to connecting. For Putty client you may use the puttygen.exe
utility to make this conversion.
See also
Setting SFTP/SSH authentication mode
64 Chapter 3 Server configuration
Server configuration 3
Setting logging preferences
JSCAPE MFT Server logs all domain activity to a log directory or JDBC accessible database. To configure logging preferences go to the Logging node in JSCAPE MFT Server Manager for the desired domain.
File Log
Logs all server activity to a directory.
Figure 12
Directory - The directory where to store log files.
File rotation - The frequency in which to rotate log files.
Database Log
Logs all server activity to a JDBC accessible database. To use the Database log option you must first create the database and necessary tables on your database server and register the appropriate database driver with JSCAPE MFT Server. Example database schema for MySQL, Microsoft SQL Server and Oracle are provided in the files etc/mysql.sql, etc/mssql.sql and etc/oracle.sql respectively.
Libraries for JDBC drivers must be placed in the libs/jdbc directory of your JSCAPE MFT Server installation, the JSCAPE MFT Server Service restarted and the JDBC driver class registered in Server >
Settings > JDBC in order for the database to be accessible to JSCAPE MFT Server.
Chapter 3 Server configuration 65
Server configuration
Figure 63
3
JDBC URL - The JDBC URL used to connect to the database. The above example demonstrates connecting to a MySQL database. Contact your database vendor for access to JDBC libraries and assistance on specifying the JDBC URL.
Username - The username to connect with when authenticating with database.
Password - The password to connect with when authenticating with database.
Pool - The maximum number of connections in database pool.
Pool timeout - The maximum amount of time in minutes that the database connection can live in the pool without activity.
Test Parameters - Tests database connection using the specified settings.
See also
Syslog
Logs all activity to a syslog daemon in addition to your existing File Log or Database Log settings. To use the Syslog option you must have an existing syslog daemon running. This may be a local or remote syslog daemon.
Figure 116
66 Chapter 3 Server configuration
Server configuration 3
Host - The IP address of syslog daemon.
Port - The port of syslog daemon.
Facility - The syslog facility to use.
Process name - Process name tag to apply to all log messages sent to syslog daemon.
Verbose Logging
If you need to debug a connection related issue it is often helpful to enable verbose logging. This can be enabled using the Settings tab and checking the Enable verbose log option. This option is disabled by default and should only be used for temporary debugging purposes as verbose logging contains a lot of information that can significantly slow performance and increase the size of log files.
Figure 65
Chapter 3 Server configuration 67
Server configuration 3
Restoring a Database Log
In the event that the database server cannot be contacted logging data will be directed to a temporary file located in the backups directory of your JSCAPE MFT Server installation. To move the contents of this temporary log file to your database use the backuplog command providing the domain that you wish to restore. The backuplog executable may be found in your JSCAPE MFT Server installation directory.
Example backuplog -domain localhost
The above command moves the contents of the temporary log file for domain localhost to the log database assigned to this domain.
Viewing log data
Log data may be viewed using any text editor or SQL client depending on the logging datastore used.
Optionally you may use the Logging > Running tab of JSCAPE MFT Server Manager to view up to the last 1000 records of log activity.
Figure 39
68 Chapter 3 Server configuration
Server configuration 3
View last X records - The number of records you want to view from end of domain log.
Pause/Resume Log - Pauses/resumes running view of log.
Reporting on log data
To create a report click on the Reports node for the desired domain. A list of existing reports will be displayed.
Figure 38
Chapter 3 Server configuration 69
Server configuration
Name - The name of the report.
Date - The date the report was created.
Description - The report description.
Search - The optional search result used to generate this report.
Status - The percentage of report completed.
Refresh - To refresh the current report view and update report status.
Add - Add a report.
Edit - Edit a report.
View - View selected report.
Re-run - Re-run selected report.
Delete - Delete selected report.
Adding a report
Click on the Add button. The Add Report dialog is displayed.
Figure 45
3
70 Chapter 3 Server configuration
Server configuration 3
Name - A unique name for this report.
Description - A description of this report.
Metrics - The metrics you wish to include in this report.
Search results - A search result to use when running this report.
Re-run search - Enable if you wish to re-run search results.
Setting user datastore
The user datastore is the location of where you will store all user and group account information. There are three types of datastores, file per record, file and database.
The file per record and file datastore are similar in that they store all user account information in a directory located on the JSCAPE MFT Server machine. The difference between the two lies in how they store account information. In the file per record datastore separate files are created for each user and each group with a .usr or .grp extension respectively. In the file datastore a single file named
Chapter 3 Server configuration 71
Server configuration 3 accounts.dat
is created to store account information and a single file named groups.dat is created to store group information. In both cases these files are stored in the specified store directory. The file per record datastore is much more efficient when managing a large number of users and is the default/ recommended choice for file based datastores.
The database datastore stores all account and group information in a relational database which may be accessed using the JDBC connection parameters that you provide.
Figure 13
Directory - The directory in which user account data will be stored. (file per record, file)
See also
Storing account details in a database
Storing account details in a database
To use the database datastore option you must first create the database on your database server.
Example database schema for MySQL, Microsoft SQL Server and Oracle are provided in the files etc/ mysql.sql
, etc/mssql.sql and etc/oracle.sql respectively. Libraries for JDBC drivers must be placed in the libs/jdbc directory of your JSCAPE MFT Server installation, the JSCAPE MFT Server
Service restarted and the JDBC driver class registered in Server > Settings > JDBC in order for the database to be accessible to JSCAPE MFT Server.
Once this is complete you go to the Datastore node and set the Store data to option to database.
Figure 14
72 Chapter 3 Server configuration
Server configuration 3
JDBC URL - The JDBC URL used to connect to the database.
Username - The username to connect with when authenticating with JDBC database.
Password - The password to connect with when authenticating with JDBC database.
Pool - The maximum number of connections in database pool.
Pool timeout - The maximum amount of time in minutes that the database connection can live in the pool without activity.
Test Parameters - Tests database connection using the specified JDBC settings.
See also
Adding users
A user is a valid account that may login to a domain's service. To view a list of users click on the Users node for the desired domain.
Figure 15
Chapter 3 Server configuration 73
Server configuration 3
To add a user click on the Add button in the lower right corner. The Add User dialog will be displayed.
Figure 16
74 Chapter 3 Server configuration
Server configuration 3
User
Name - The full name of this user.
Login - The login name for this user.
Password - The password for this user.
Re-type password - The password for this user.
Email - Optional email address for this user.
Company - The company that this user is associated with.
Phone - The phone number for this user. The first field is the country code (e.g. "1" for United States) and the second field is the telephone number including any area code, the third field is the phone extension.
This field is used primary in conjunction with Phone Authentication.
Groups - Optional groups that this user is a member of.
Settings
Chapter 3 Server configuration 75
Server configuration 3
Enabled - Check to enable this account.
Owner - Optional login of user who owns/manages this account.
Expires on - Date that this account expires (leave blank for non-expiring account).
Enable ad-hoc email transfers - Check to allow user to perform ad-hoc email transfers via HTTP interface.
Authentication
Require secured connection - Check to force user to login using secure protocol (e.g. FTPS/SFTP/HTTPS).
Allow password change - Check to allow user to change their password.
Use phone authentication - Check to require user to use two-factor phone authentication.
Ignore password aging rules - Check to disable password aging rules for this user.
Client keys - Optional public-keys bound to this user for purposes of public-key authentication in SFTP/
SSH protocol.
See also
Defining user templates
A user template is a template that is used for creating users. To view a list of available templates click the
Users > Templates panel for the desired domain.
Figure 112
76 Chapter 3 Server configuration
Server configuration 3
To add a user template click on the Add button in the lower right corner. The Add User Template dialog will be displayed.
Figure 113
Chapter 3 Server configuration 77
Server configuration 3
User
Template name - The name of this template.
Name - The full name of this user.
Email - Optional email address for this user.
Company - The company that this user is associated with.
Phone - The phone number for this user. The first field is the country code (e.g. 1 for United States) and the second field is the telephone number including any area code, the third field is the phone extension.
This field is used primary in conjunction with
.
Groups - Optional groups that this user is a member of.
Settings
Enabled - Check to enable this account.
Owner - Optional login of user who owns/manages this account.
78 Chapter 3 Server configuration
Server configuration 3
Expires on - Date that this account expires (leave blank for non-expiring account).
Enable ad-hoc email transfers - Check to allow user to perform ad-hoc email transfers via HTTP interface.
Authentication
Require secured connection - Check to force user to login using secure protocol (e.g. FTPS/SFTP/HTTPS).
Allow password change - Check to allow user to change their password.
Use phone authentication - Check to require user to use two-factor phone authentication.
Ignore password aging rules - Check to disable password aging rules for this user.
Client keys - Optional public-keys bound to this user for purposes of public-key authentication in SFTP/
SSH protocol.
Assigning domain administrators
A domain administrator can manage and create users using the account management features available in the web interface. To assign domain administration privileges for a user go to the Users node for the desired domain, select the user you wish to assign domain administration rights to, click the Edit button and go to the Domain Administration tab.
Figure 114
Chapter 3 Server configuration 79
Server configuration 3
Allow domain administration - Enables/disables if user is a domain administrator.
General
Allow management of non-owned users - If checked then user can manage any accounts for the domain.
Otherwise user can only manage accounts that are "owned" by this user.
Allow usage of system OpenPGP keys - If enabled user will be able to view OpenPGP keys created in Key
Manager .
Share bandwidth quotas with owned users - If checked then all owned users bandwidth rolls up to domain administrator user bandwidth quota where the sum of owned user bandwidth may not exceed that of the domain administrator bandwidth quota.
Max number of owned users - The maximum number of users this user may create/own.
Allow management of public contacts - If enabled user will be able to create/manage public contacts visible by all users for the domain.
User templates - The templates that domain administrator may use when creating a user.
User Limitations
80 Chapter 3 Server configuration
Server configuration 3
Restrict user paths to - If checked then user can only create virtual directories with the specified path or below.
Allow assignment of groups to users - If checked user can assign a user to a group.
Allow assignment of reverse proxies to user virtual directories - If checked user can map virtual directories to a reverse proxy.
Allow enabling of phone authentication for users - If checked then user can enable/disable the Use phone authentication option for users.
Drop Zones / URL Branding
Allow management of drop zones - If enabled then user can create drop zones.
Allow management of URL brandings - If checked then user can create URL branding links.
Max number of drop zones - The maximum number of drop zones that user can create.
Max number of URL brandings - The maximum number of URL branding links that user can create.
See also
Setting authentication preferences
Users may authenticate with JSCAPE MFT Server using a variety of different authentication protocols. To view the current authentication method used click on the Authentication node for the desired domain.
Domain User Authentication
Domain User Authentication is the most basic form of authentication, authenticating against local user accounts created for the domain using JSCAPE MFT Server Manager.
Figure 58
Chapter 3 Server configuration 81
Server configuration 3
Database User Authentication
Database User Authentication allows you to authenticate a user based on whether the user has credentials to connect to a database. When connecting to the supplied JDBC URL the username and password provided at time of login are used to login to the JDBC URL. If user authenticates successfully with the JDBC URL then user is considered a valid user of the JSCAPE MFT Server service.
Figure 59
JDBC URL - The JDBC URL used to connect to the database. Libraries for JDBC drivers must be placed in
82 Chapter 3 Server configuration
Server configuration the libs/jdbc directory of your JSCAPE MFT Server installation, the JSCAPE MFT Server Service restarted and the JDBC driver class registered in Server > Settings > JDBC in order for the database to be accessible to JSCAPE MFT Server.
3
Create account if not found using template - This allows for accounts to be created automatically upon successful authentication. If selected, an account will be created automatically (if it does not exist already) using the specified User Template.
Convert username before creation to - If enabled, the username supplied will be converted to specified case before passing username to specified User Template.
Database Query Authentication
Database Query Authentication allows you to authenticate a user based on the results of a database query. If one or more records are returned from the query then the user is successfully authenticated.
Figure 60
JDBC URL - The JDBC URL used to connect to the database. Libraries for JDBC drivers must be placed in the libs/jdbc directory of your JSCAPE MFT Server installation, the JSCAPE MFT Server Service restarted and the JDBC driver class registered in Server > Settings > JDBC in order for the database to be accessible to JSCAPE MFT Server
User - The username to connect with when authenticating with JDBC database.
Password - The password to connect with when authenticating with JDBC database.
SQL query - The query to perform to authenticate the user. There are two special variables that may be used when performing the database query %username% and %password% which refer the username and password passed in during the authentication process. Note, SQL queries and stored procedures may be
Chapter 3 Server configuration 83
Server configuration 3 used, however stored procedures which make use of output parameters may not be used. The variables % username% and %password% are treated as strings so must be enclosed in single quotes.
Hash password class - The Java class to use for hashing password before passing to SQL query. If no class is specified then password will be passed to SQL query in clear text.
Create account if not found using template - This allows for accounts to be created automatically upon successful authentication. If selected, an account will be created automatically (if it does not exist already) using the specified User Template.
Convert username before creation to - If enabled, the username supplied will be converted to specified case before passing username to specified User Template.
See also
LDAP User Authentication
LDAP User Authentication allows you to authenticate a user based on whether the user has the credentials to connect to the LDAP or Active Directory service.
Figure 61
Host - The hostname or IP address of the LDAP service.
Port - The port of the LDAP service.
Timeout - The connection timeout when connecting to LDAP service.
User DN - The users distinguished name for authenticating with the LDAP service. The variable % username% may be used which refers to the username passed in during the authentication process.
84 Chapter 3 Server configuration
Server configuration 3
Use SSL connection - Connect to LDAP server using SSL connection.
Allow anonymous binding - Sets whether user can bind anonymously to LDAP directory.
Create account if not found using template - This allows for accounts to be created automatically upon successful authentication. If selected, an account will be created automatically (if it does not exist already) using the specified User Template.
Convert username before creation to - If enabled, the username supplied will be converted to specified case before passing username to specified User Template.
Use failover server - If enabled and primary LDAP server is inaccessible then authentication will be attempted against failover server.
LDAP Query Authentication
LDAP Query Authentication allows you to authenticate a user based on the results of a LDAP query and is a two step authentication process.
1. User is authenticated against LDAP server using the User DN field and the password supplied by user when authenticating against JSCAPE MFT Server file transfer service.
2. Query is performed using credentials supplied in Search user DN and Password fields. Note, these credentials may be different than the credentials used in Step 1. For example, a case where these might be different is where the User DN does not have the needed permissions to perform the query but the Search User DN does.
If one or more records are returned from the query then the user is successfully authenticated.
Figure 62
Host - The hostname or IP address of the LDAP service.
Port - The port of the LDAP service.
Chapter 3 Server configuration 85
Server configuration 3
Timeout - The connection timeout when connecting to LDAP service.
User DN - The users distinguished name for authenticating with the LDAP service.
Search user DN - The user distinguished name used for performing LDAP search query.
Password - The user password for performing LDAP search query.
Base DN - The base distinguished name in which to perform the filter.
Filter - The filter to execute using the LDAP filter syntax. There are two special variables that may be used when performing the database query, %username% and %password% which refer the username and password supplied by the user during the authentication process.
Hash password class - The Java class to use for hashing password before passing to filter. If no class is specified then password will be passed to Filter in clear text.
Use SSL connection - Connect to LDAP server using SSL connection.
Use failover server - If enabled and primary LDAP server is inaccessible then authentication will be attempted against failover server.
Create account if not found using template - This allows for accounts to be created automatically upon successful authentication. If selected, an account will be created automatically (if it does not exist already) using the specified User Template.
Convert username before creation to - If enabled, the username supplied will be converted to specified case before passing username to specified User Template.
See also
LDAP Filter Grammar
When using LDAP Query Authentication you must define a filter that will be used to identify the record you are searching for. The syntax of LDAP filters are defined in RFC 2254. The table below provides a list of valid expressions and their meanings.
Symbol
=
>
>=
<
Filter
Equality
Greater than
Greater than or equal to
Less than
Example
(sn=Smith)
(sn>Smith)
(sn>=Smith)
(sn<Smith)
Example matches
Surname of Smith only.
Any surname that alphabetically follows
Smith.
Any surname that includes or alphabetically follows
Smith.
Any surname that
86 Chapter 3 Server configuration
Server configuration
<=
=*
=*
&
!
|
Less than or equal to
Presence
Substring
And
Or
Not
3
(sn<=Smith) alphabetically precedes
Smith.
Any surname that includes or alphabetically precedes
Smith.
(sn=*)
(sn=Smi*)
All surnames (all entries with the sn attribute).
Any matching substring of Smith.
(& (sn=Smith) (cn=John)
)
Surname of Smith and common name of John.
(| (sn=Smith) (sn=Jones)
)
Surname of Smith or
Jones.
(! (sn=Smith)) Surname not equal to
Smith.
See also
Authenticating with Microsoft Active Directory
NTLM Authentication
Using NTLM Authentication you may authenticate against an existing Windows domain.
Figure 118
Host - The IP address of Windows domain controller.
Windows domain - The name of the Windows domain to which users belong.
Chapter 3 Server configuration 87
Server configuration 3
Create account if not found using template - This allows for accounts to be created automatically upon successful authentication. If selected, an account will be created automatically (if it does not exist already) using the specified User Template.
Convert username before creation to - If enabled, the username supplied will be converted to specified case before passing username to specified User Template.
PAM Authentication
Using PAM Authentication you may authenticate against an existing UNIX PAM user repository. In order to use the PAM Authentication module you must install some native libraries that allow JSCAPE
MFT Server to communicate with your PAM user repository.
1.
Download the JPam library for your operating system.
2. Copy the native library to the Java Native Libary Path. See the Native Library Installation Location table for details. Note, Step 1 in the JPam instructions should be ignored as the jpam.jar file already exists in the libs directory of your JSCAPE MFT Server installation. Additionally, JPam instructions state you may optionally place native library in same directory as the jpam.jar file instead of the Java
Native Library Path. This is incorrect. For JPam to work with JSCAPE MFT Server you must place native library in the Java Native Library Path and not in the libs directory of JSCAPE MFT Server.
3.
Configure JPam for use by editing the net-sf-jpam file and copying it to to /etc/pam.d directory.
4. Restart JSCAPE MFT Server Service.
5. Using JSCAPE MFT Server Manager go to the Authentication node and set the Service type to
PAM authentication and enable other options. See Figure 117.
6. Click Test Parameters button to test.
Figure 117
88
Enable debug to file system_output.log - Sends debugging information to file system_output.log in installation directory.
Create account if not found using template - This allows for accounts to be created automatically upon
Chapter 3 Server configuration
Server configuration successful authentication. If selected, an account will be created automatically (if it does not exist already) using the specified User Template.
3
Convert username before creation to - If enabled, the username supplied will be converted to specified case before passing username to specified User Template.
Custom User Authentication
Using Custom User Authentication you may define your own custom authentication class.
Figure 86
Authentication class - The custom authentication class name.
Create account if not found using template - This allows for accounts to be created automatically upon successful authentication. If selected, an account will be created automatically (if it does not exist already) using the specified User Template.
Convert username before creation to - If enabled, the username supplied will be converted to specified case before passing username to specified User Template.
See also
Authenticating using custom authentication API
Password Hashing
The Database Query Authentication and LDAP Query Authentication services both support optional password hashing. Many databases and LDAP repositories store passwords in a hashed format. This is a security measure used in order to protect user credentials should a database or LDAP repository be compromised. JSCAPE MFT Server includes some built-in classes that may be used for hashing a password before it is sent for authentication against a database or LDAP repository. These classes are com.jscape.inet.mft.authentication.MD5Hasher and com.jscape.inet.mft.authentication.SHA1Hasher
which offer MD5 and SHA1 hashes
Chapter 3 Server configuration 89
90
Server configuration 3 respectively. Note, the hashes provided by the MD5Hasher and SHA1Hasher classes are provided in lowercase format.
Some databases or LDAP repositories may store passwords in a salted hash format. In a salted hash format the password is combined with other data (the salt) prior to being hashed. Salted hash passwords are typically used in an effort to avoid brute-force password attacks should the database or LDAP repository be compromised. Password salting is generally application dependent, therefore should you need to use a salted password it is necessary to write your own password hasher using the JSCAPE MFT
Server API. To implement your own password hashing provider you must perform the following:
1. Create a Java class which implements the com.jscape.inet.mft.authentication.Hasher
class.
2. Overload the public String createHash(String login, String password) method, returning the hashed value.
3. Create a JAR file that contains the compiled version of your com.jscape.inet.mft.authentication.Hasher
implementation. To compile your authentication class you will need to include the ftpserver.jar library in your classpath. The ftpserver.jar
library may be found in the libs directory for JSCAPE MFT Server.
4. Place the JAR file created in step 3 into the libs directory of your JSCAPE MFT Server installation.
5. Shutdown any open instances of JSCAPE MFT Server Manager and restart the JSCAPE MFT Server
Service.
6. In the Hash password class field of the Database Query Authentication or LDAP Query
Authentication service enter the full classname, including package name of your hash provider.
Phone Authentication
The Phone Authentication module in JSCAPE MFT Server provides tokenless two-factor authentication support for your user accounts. This is a very secure method of authenticating users in that it combines something users know (their username/password) with something they have (a telephone or cellphone). Using the Phone Authentication module ensures that even if a user's password is stolen their account cannot be compromised.
How it work s
1. User authenticates with JSCAPE MFT Server service as normal.
2. User instantly receives a phone call from Two-Factor Authentication service asking user to confirm this is a valid login.
3. Upon confirmation, user is logged into their account.
Enabling Phone Authentication
1. Select the Two-Factor Authentication tab and the Service type you wish to use.
2. Enter details for service and click Apply.
3. Enable the Use phone authentication option for those user accounts that you want to use this service.
Microsoft Azure Multi-Factor Authentication (a.k.a PhoneFactor) is a multi-factor authentication service provided by Microsoft. To use this service you must first create an Azure account and Download Azure
Multi-Factor Authentication SDK for Java. Upon downloading the SDK, extract the ZIP archive and copy
Chapter 3 Server configuration
Server configuration the files license.xml and cert.p12 to the License directory. See Figure 119.
Figure 119
3
License directory - The directory containing your Microsoft Azure Multi-Factor Authentication SDK license and private key files.
Password - Your Microsoft Azure Multi-Factor Authentication account password. This password can be found in the private-key-password.txt file that was provided as part of the Microsoft Azure Multi-Factor
Authentication download.
Allow international calls - If checked fee based calls may be made to areas outside of the free Global
Services locations defined by Microsoft Azure Multi-Factor Authentication.
Figure 120
Chapter 3 Server configuration 91
Server configuration 3
Note
Make sure that you enter the country code and phone number (including any area code) in the Phone field for your users using this service. The first field is your country code (1 for the United States), the second field is your phone number (including any area code), the third field is an optional extension. It is important that you do not include any non-numeric values in your phone number (e.g. hyphens, parenthesis etc.).
This will be the number that is called when performing phone authentication.
Web SSO
SSO (Single-Sign-On) is a method by which users can login to one service (identity provider) and automatically be granted access to other services (service provider) without the need to login separately to these other services. An example of this would be logging into Google Apps and automatically be granted access to your JSCAPE MFT Server account without the need for a separate login. In the example screenshot below (Figure 171) Google Apps would serve as the identity provider and your JSCAPE MFT
Server instance as the service provider. JSCAPE MFT Server provides support for web based SSO using
SAML, OpenID and OpenID Connect compliant identity providers. Please consult the documentation of your identity provider for details on how to enable/configure SSO.
Login URL
To perform a web SSO login use the following URL format:
92 Chapter 3 Server configuration
Server configuration 3 https://[hostname]/sso/[domainname]/login
For example, if your hostname is 1.2.3.4 and your domain is mydomain this URL would look as follows: https://1.2.3.4/sso/mydomain/login
If you have already authenticated with your identity provider then you will be automatically logged into
JSCAPE MFT Server. If not, then you will be redirected to the Sign-in URL for your identity provider. After authenticating with your identity provider you will be automatically logged into JSCAPE MFT Server.
Note
SSO applies only to web based sessions. Other protocols (FTP/S, SFTP, WebDAV, AFTP etc.) will authenticate users using the defined authentication service for the domain.
OpenID Example
Figure 171
Sign-in URL - The URL used for signing into the identity provider.
Sign-out URL - The URL to be redirected to upon clicking Logout link in web interface.
Create account if not found using template - This allows for accounts to be created automatically upon successful authentication. If selected, an account will be created automatically (if it does not exist already) using the specified User Template. The Name and Login properties for the account created will automatically be set to the openid.identity attribute value.
Convert username before creation to - If enabled, the username supplied will be converted to specified case
Chapter 3 Server configuration 93
Server configuration before passing username to specified User Template.
Allow non SSO logins - If enabled, user may login using either SSO or other authentication service
3
Authenticating with Microsoft Active Directory
Microsoft Active Directory is an LDAP service that may be used by external applications to authenticate users against a Microsoft domain. To use Active Directory for authentication purposes you may use any of the LDAP service types provided in the Authentication node of JSCAPE MFT Server Manager.
Verifying Active Directory Installation
Setting Authentication Details
Verifying Active Directory Installation
Prior to using LDAP you must first verify that you have Active Directory properly installed on the server you are authenticating against. To see if it is enabled on the server go to Start > Programs >
Administrative Tools > Active Directory Users and Computers . If you do not see this menu option then it is likely you don't have Active Directory installed on this server. Please consult your
Microsoft documentation for instructions on how to install and configure Active Directory.
Obtaining Zone Name
Open the Active Directory manager from Start > Programs > Administrative Tools >
Active Directory Users and Computers . Here you should node with a name like ad.domain.com
or something similar. This is your zone name and will be used when setting your authentication details in JSCAPE MFT Server Manager. Beneath this zone you should see a Users folder that lists all the users for this system. You may have other folders in this directory. Please make note of the folder that contains the users you wish to authenticate with as this will be needed when constructing your User DN.
Setting Authentication Details
Using JSCAPE MFT Server Manager go to the Authentication node and set the Service type to
LDAP authentication . Enter the connection details for your Active Directory service.
Figure 61
94 Chapter 3 Server configuration
Server configuration 3
Host - The hostname or IP address of the LDAP service.
Port - The port of the LDAP service.
Timeout - The connection timeout when connecting to LDAP service.
User DN - The users distinguished name for authenticating with the LDAP service. The variable % username% may be used which refers to the username passed in during the authentication process.
Use SSL connection - Connect to LDAP server using SSL connection.
Allow anonymous binding - Sets whether user can bind anonymously to LDAP directory.
Create account if not found using template - This allows for accounts to be created automatically upon successful authentication. If selected, an account will be created automatically (if it does not exist already) using the specified User Template.
Convert username before creation to - If enabled, the username supplied will be converted to specified case before passing username to specified User Template.
Use failover server - If enabled and primary LDAP server is inaccessible then authentication will be attempted against failover server.
Testing Connection
To test your Active Directory connection click the Test Parameters button on this panel and enter a valid username/password for the Active Directory service when prompted.
Firewall Configuration
You may need to change your server configuration to allow inbound requests on port 389. If needed this can be done via the Control Panel > Network Connections menu in Windows. From here rightclick on the desired network interface and click the Properties > Advanced > Settings menu
Chapter 3 Server configuration 95
Server configuration 3 option. In the Exceptions tab add port 389 to allow inbound connections to this port.
See also
Setting authentication preferences
Authenticating using custom authentication API
The custom authentication API provides you with a way to authenticate users using your own business rules. The custom authentication API is recommended when the other built-in authentication modules
(Database, LDAP, Domain) do not meet your needs. To implement your own authentication provider you must perform the following:
1. Create a class which implements the com.jscape.inet.mft.subsystems.authentication.AuthenticationService
class.
2. Overload the public void authenticate(Credentials creds) method, throwing a com.jscape.inet.mft.subsystems.authentication.AuthenticationException
exception if authentication fails.
3. Create a JAR file that contains the compiled version of your com.jscape.inet.mft.subsystems.authentication.AuthenticationService
implementation. To compile your authentication class you will need to include the ftpserver.jar
library in your classpath. The ftpserver.jar library may be found in the libs directory for JSCAPE
MFT Server.
4. Place the JAR file created in Step 3 as well as any needed 3rd party JAR files into the libs/ext directory of your JSCAPE MFT Server installation.
5. Restart the JSCAPE MFT Server Service.
6. Open JSCAPE MFT Server Manager and select the Authentication node.
7. Change Service type to custom authentication. Type in the class name created in Step 1 into the Authentication class field.
Figure 86
96 Chapter 3 Server configuration
Server configuration 3
Authentication class - The custom authentication class name.
Create account if not found using template - This allows for accounts to be created automatically upon successful authentication. If selected, an account will be created automatically (if it does not exist already) using the specified User Template.
Convert username before creation to - If enabled, the username supplied will be converted to specified case before passing username to specified User Template.
Example package test.jscape; import com.jscape.inet.mft.subsystems.authentication.AuthenticationException; import com.jscape.inet.mft.subsystems.authentication.Credentials; import com.jscape.inet.mft.subsystems.authentication.AuthenticationService;
/**
* Example class to implement IP/user based authentication
*/ public class UserIPAuthentication implements AuthenticationService { private static final String username = "jsmith" ; private static final String password = "secret" ; private static final String ip = "127.0.0.1" ;
/**
* Authenticate user credentials
*/ public void authenticate(Credentials creds) throws
AuthenticationException { if (creds.getLogin().equals( username ) && creds.getPassword()
.equals( password )
Chapter 3 Server configuration 97
Server configuration 3
&& creds.getClientIp().equals( ip )) { throw new AuthenticationException( "Authentication failed: "
+ creds.getLogin() +
":" + creds.getClientIp() + ":" + creds.getPassword());
}
}
// ignore
} else {
}
The example above authenticates successfully if the username is "jsmith", the password is "secret" and the client IP address is "127.0.0.1".
See also
Setting authentication preferences
Adding anonymous user accounts
For security reasons anonymous access by default is not enabled. To enable anonymous access simply create a new user account with the login name of anonymous and an empty password.
See also
Defining virtual paths
Virtual paths are virtual file system paths that map to a physical path on your domain and have their own set of permissions. This allows you to have complete control over what resources users may access on your domain without having to manage users and permissions at the OS level. Virtual paths may be defined at the User, User Template or Group levels. Defining virtual paths at the Group or User
Template level is recommended when you want to assign multiple users the same set of virtual paths.
Creating virtual paths for a User account
1. From the Users node select the user you wish to define the virtual paths for and click the Edit button.
The Edit User dialog is displayed.
Figure 120
98 Chapter 3 Server configuration
Server configuration 3
2. Click on the Paths tab to see a list of virtual paths for this user. To add a new virtual path click on the
Add button.
Figure 42
Chapter 3 Server configuration 99
Server configuration 3
Path - The virtual path that will be made available to the User account. Virtual paths should always start with a slash / character. For example a valid virtual path might be /docs
Real path - The real path on your domain that this virtual path maps to.
Reverse Proxy - If you are mapping this path to a reverse proxy then select it here.
Create directory if not found - Creates directory on server if not found when accessed by user.
Include in search index - If checked files in directory will be indexed for search purposes.
Permissions - Check the permissions that this user will be granted for the virtual path.
3. To finish, click OK. Your new virtual path will be displayed in the virtual path listing for the user account.
Creating virtual paths for a Group
When creating a virtual path for a group, all users who are members of the group will have access to the virtual path.
100
1. From the Groups node select the group you wish to define the virtual paths for and click the Edit
Chapter 3 Server configuration
Server configuration button. The Edit Group dialog is displayed.
Figure 43
3
2. A list of virtual paths is displayed at the bottom of the screen for this group. To add a path click the
Add button.
Figure 191
Chapter 3 Server configuration 101
Server configuration 3
102
Path - The virtual path that will be made available to the User account. Virtual paths should always start with a slash / character. For example a valid virtual path might be /docs
Real path - The real path on your domain that this virtual path maps to.
Reverse Proxy - If you are mapping this path to a reverse proxy then select it here.
Create directory if not found - Creates directory on server if not found when accessed by user.
Include in search index - If checked files in directory will be indexed for search purposes.
Permissions - Check the permissions that this user will be granted for the virtual path.
PGP encrypt uploads - Files uploaded to this directory will be automatically PGP encrypted using specified key.
Enable DLP - Files downloaded from this directory are subject to DLP rules.
Secured - If checked, this directory may only be accessed using secure protocols (FTPS, SFTP, HTTPS
Chapter 3 Server configuration
Server configuration 3 etc.).
Denied - If checked, this directory may not be accessed. This option is typically used to override the behavior of a parent directory, where access to parent directory is granted but access to this sub-directory is denied.
3. To finish, click OK. Your new virtual path will be displayed in the virtual path listing for the Group.
Variables
Variables may be used in Path and Real Path fields for purposes of creating dynamic paths. Available variables are described below.
installdir - The absolute path of JSCAPE MFT Server installation directory.
domain - The domain that this user/group belongs to.
sessionid - Unique session ID for the user. This ID is unique for each login.
username - The username of connected user.
group - The optional group name that this user belongs to. Note, this variable is deprecated and is provided only for backwards compatibility. Users may belong to more than one group. This variable will return only the first group that user belongs to if found.
queryattr[‘name’] - If LDAP or Database authentication methods are used this will return the attribute of the matching record found during authentication. For example, if user is authenticating against a relational database using the query select name from users where username = '%username
%' and password = '%password%' the variable queryattr['name'] would return the matching name value returned by the database query.
Virtual path permissions
In the Permissions column of a virtual path you will find a series of letters and optional dashes. In the event one or more permissions are not granted this will be represented by a dash (-) character, indicating the specified permission has been taken away. A character map defining these letters in order of occurrence is provided below.
R - Download file
W - Upload file
A - Append file
D - Delete file
R - Rename file
L - List files
C - Make dir
D - Delete dir
L - List subdirs
B - Browse subdirs
Figure 134
103 Chapter 3 Server configuration
Server configuration 3
Adding groups
A group is a named set of virtual directories and file system permissions that may be assigned to zero or more user accounts. This is useful in the event you wish to manage permissions for multiple users based on user roles. To view a list of groups click on the Groups node for the desired domain.
Figure 26
104 Chapter 3 Server configuration
Server configuration 3
Add Group
To add a group click on the Add button in the lower right corner. The Add Group dialog will be displayed.
Figure 27
Name - The unique name for this group.
Path - The unique virtual path for this group.
Real path - The real physical directory for this path. Note: You will be able to add more virtual paths and permissions using the Edit Group function.
Chapter 3 Server configuration 105
Server configuration 3
Reverse proxy - The reverse proxy to associate with this path.
Edit Group
To edit a group, highlight the group name you would like to edit and click the Edit button. The Edit
Group dialog is displayed.
Figure 31
Path - The virtual path.
Real Path/Reverse Proxy - The real path or reverse proxy this path is mapped to.
Permissions - The permission settings for this path.
Setting IP based access
As an improved security measure you may define what IP addresses are allowed or disallowed access to your domain services. To view a list of IP access rules click on the IP Access node for the desired domain.
106 Chapter 3 Server configuration
Server configuration
Figure 29
3
IP Mask - The IP address mask.
Access - Indicates whether access is allowed or denied.
Reason - The reason access is allowed or denied.
Access rules are processed in the order listed. For each connection the first matching access rule will be used. Therefore it is important that the access rules be ordered correctly to prevent a user from being mistakenly denied or granted access. You may use the Up and Down buttons to order these access rules to suit your needs.
Add IP access rule
To add an access rule click on the Add button in the lower right corner. This will display the Add IP
Access Rule dialog.
Figure 30
Chapter 3 Server configuration 107
Server configuration 3
IP mask - The IP address or IP address mask to allow or deny access.
Reason - Reason access is allowed or denied.
Access allowed - Select to have access allowed.
Access denied - Select to have access denied.
IP mask examples
Examples of valid IP masks are as follows:
192.168.1.1
- Allows/Blocks a single IP address
192.168.1.* - Allows/Blocks all IP addresses in a class C IP block.
192.168.*.* - Allows/Blocks all IP addresses in a class B IP block.
*.*.*.* - Allows/Blocks all IP addresses.
Setting time based access
ou may limit the time of day that users may connect to your services. To enable these settings go to the
Time Access node for the desired domain. If a day is enabled, then users may only access services between the period specified for that day. If a day is not enabled then there is no restriction on what time of day the user may access services. Dates/times are based on the current local time on the server.
For example, in Figure 131 below users may access services Tuesday thru Sunday without restriction. On
Mondays user may only connect between 6:00 AM and 12:00 noon local time.
Figure 131
108 Chapter 3 Server configuration
Server configuration 3
Enable time access - Enables or disables time based access.
Setting banned files
You may limit the files that user can upload based on filename. To enable these settings go to Banned
Files node for desired domain. If enabled then uploading files matching any of the regular expressions will be disallowed.
For example, in Figure 132 below, users may not upload files with a .exe extension.
Figure 132
Chapter 3 Server configuration 109
Server configuration
Path - The virtual directory path to which this rule should be applied.
Recursive - If enabled, this rule will be applied to all directories beneath virtual directory path.
Pattern - The regular expression to use for this rule.
Scope - The scope of this rule.
3
See also
Regular expression reference
Setting connection preferences
There are various connection preferences that may be used to define how users may connect to domain services you create. These preferences may be managed under the Connections and Services nodes.
General Connection Settings
General connection settings apply to all file transfer protocols including AS2, FTP/S, SFTP/SCP, HTTP/S,
WebDAV and AFTP and may be set using the Connections node.
Figure 28
110 Chapter 3 Server configuration
Server configuration 3
Max concurrent connections - The maximum number of concurrent connections allowed. Note: This value may not exceed the concurrent connection limit of your license type.
Max connections/IP - The maximum number of active connections from a single client IP address.
Max connections/user - The maximum number of active connections from a single user.
Max downloads/session - The maximum number of downloads per client session.
Max uploads/session - The maximum number of uploads allowed per client session.
Max file download size (MB) - The maximum file download size in MB.
Max file upload size (MB) - The maximum file upload size in MB.
Max uploads (MB) - Defines an upload quota for the domain that is reset every N days. If upload quota is exceeded no further uploads are allowed until upload quota is reset.
Max downloads (MB) - Defines a download quota for the domain that is reset every N days. If download quota is exceeded no further downloads are allowed until download quota is reset.
Max transfers (MB) - Defines a transfer quota for the domain that is reset every N days. If transfer quota is exceeded no further file transfers are allowed until transfer quota is reset. Transfers are the combined sum of uploads and downloads.
Disable account after X invalid password attempts in Y min - Disables account for a certain period of time if too many login attempts fail within a certain period of time.
Disable IP after X invalid password attempts in Y min - Blocks IP from further access for a certain period of time if too many login attempts fails within a certain period of time.
Flag IP after X invalid password attempts in Y min - Flags IP for a certain period of time if too many login attempts fails within a certain period of time. Note, flagging an IP has no affect on the users ability to connect. This will result in an IP Flagged event being raised and is intended primarily for integrating with other applications such as JSCAPE MFT Gateway .
FTP/S Connection Settings
FTP/S connection settings may be managed under the Services > FTP/S panel.
Figure 70
111 Chapter 3 Server configuration
Server configuration 3
Connections
Banner - The banner to display to FTP clients.
Command channel timeout (min) - The time in minutes that a client may remain inactive on command channel before server forcefully disconnects client.
Data channel timeout (min) - The time in minutes that a client may remain inactive on data channel before server forcefully disconnects client.
Passive IP - The IP to use when responding to PASV client requests.
Passive port range - The port range on the server to use for servicing PASV client requests.
Data channel send buffer - The size of send buffer for data channel. Default is send buffer size for JVM.
Data channel receive buffer - The size of receive buffer for data channel. Default is the receive buffer size for
JVM.
Security
Require data channel encryption - If enabled client will be required to encrypt data channel when using
FTPS (FTP over SSL) protocol.
Require client certificate - If enabled users authenticating using FTPS (FTP over SSL) will be required to authenticate using data encrypted with a private key that maps to a server installed client certificate.
Require client certificate for data channel - If enabled users requesting data transfer using FTPS (FTP over
SSL) will be required to supply data encrypted with a private key that maps to a server installed client certificate.
Block PASV attack - If enabled users will only be allowed to connect to passive data ports that are initiated by same client on command channel.
112 Chapter 3 Server configuration
Server configuration
Shutdown SSL for CCC command - If enabled client must properly shutdown SSL connectiosn for command channel when issuing CCC command.
3
Shutdown SSL for data connection - If enabled client must properly shutdown SSL data connections.
SSL Ciphers - The SSL ciphers to enable for FTPS (FTP over SSL) services.
SFTP/SCP Connection Settings
SFTP/SCP connection settings may be managed under the Services > SFTP/SCP panel.
Figure 71
Software version - The SSH version banner displayed when connecting. Note, it is important that this not contain any spaces.
Startup banner - The banner to display to SFTP clients prior to displaying SSH version banner.
Authentication banner - The banner to display to SFTP clients prior to displaying authentication prompt.
Connection timeout - The time in minutes that client connection may remain inactive before server forcefully disconnects client.
Connection send buffer - The size of send buffer. Default is send buffer size for JVM.
Connection receive buffer - The size of receive buffer. Default is the receive buffer size for JVM.
Disable expanded longname format for SSH_FXP_REALPATH - May be required for some SFTP clients that cannot handle long paths in SSH_FXP_REALPATH packets.
Algorithms - Lists all algorithms and ciphers, their order of preference and whether they are enabled.
See also
Chapter 3 Server configuration 113
Server configuration
Additional libraries needed for SFTP ciphers
AFTP Connection Settings
AFTP connection settings may be managed under the Services > AFTP panel.
Figure 163
3
Connection channel timeout (min) - The time in minutes that client channel (TCP) connection may remain inactive before server forcefully disconnects client.
Data channel timeout (min) - The time in minutes that client data (UDP) connection may remain inactive before server forcefully disconnects client.
Max loss list size - The maximum number of lost blocks of data that may exist in memory for a client session.
SSL Ciphers - The SSL ciphers to enable for AFTP services.
OFTP Connection Settings
OFTP connection settings may be managed under the Services > OFTP panel.
Figure 192
114 Chapter 3 Server configuration
Server configuration 3
Connection timeout - Connection channel timeout (min) - The time in minutes that client channel (TCP) connection may remain inactive before server forcefully disconnects client.
Max data buffer size - The maximum data buffer size for OFTP connections.
Max credit - The maximum number of packets that client may send to server before receiving an acknowledgment from server that is it ready to receive more data.
SSL Ciphers - The SSL ciphers to enable for OFTP services.
TFTP Connection Settings
TFTP connection settings may be managed under the Services > TFTP panel.
Figure 193
Chapter 3 Server configuration 115
Server configuration 3
Max retransmit attempts - The maximum number of times that sender may unsuccessfully send a message before failure.
Retransmit interval - The retransmission interval (seconds) between each message retransmission attempt.
Generate dir.txt file if missing - If checked client may request the file dir.txt to obtain a directory listing of available files.
Generate .md5 file if missing - If checked client may request any filename with a .md5 extension to obtain an MD5 hash of filename contents.
HTTP/S Connection Settings
HTTP/S connection settings may be managed under the Services > HTTP/S panel.
Figure 89
116 Chapter 3 Server configuration
Server configuration 3
Logo - The logo displayed in upper left corner when using HTML user interface.
Logout URL - The URL to redirect user to upon clicking Logout link.
Connection timeout - The connection timeout for HTTP requests in minutes.
Enable automatic logout - If checked, user will be automatically logged out after X minutes of inactivity with grace period of Y seconds.
Enable web document viewer - If checked web document viewer is enabled.
Enable ad-hoc file transfers - If checked ad-hoc file transfers will be enabled for the domain.
Show buttons shortcuts - If checked, button shortcuts (e.g. F2, F5, F7) are displayed on buttons.
Show login info - If checked, the current username and domain is displayed in upper right.
Show search - If checked searches on indexed documents may be performed.
Show ASCII/Binary option - If checked, user has option of uploading files in both ASCII and binary modes.
If unchecked only binary is allowed by default and user does not have ability to change this setting.
Show account link - If checked the My Account link is displayed in upper right allowing users to change their account contact information.
AFTP NAT Host - The host to use when connecting to AFTP service using Java applet.
Forms... - Forms available during file upload when using HTML user interface.
Resources... - The current language resource file. Language resource files are used for specifying alternative user interface labels based on client browser default language.
WebDAV/S Connection Settings
Chapter 3 Server configuration 117
Server configuration
WebDAV/S connection settings may be managed under the Services > WebDAV/S panel.
Figure 90
3
118
Logo - The logo displayed in upper left corner when using WebDAV user interface.
Logout URL - The URL to redirect user to upon clicking Logout link.
Enable Java applet - If checked, Java applet interface is enabled for WebDAV connections.
Enable web document viewer - If checked web document viewer is enabled.
Show login info - If checked, the current username and domain is displayed in upper right.
Show account link - If checked the My Account link is displayed in upper right allowing users to change their account contact information.
Resources... - The current language resource file. Language resource files are used for specifying alternative user interface labels based on client browser default language.
Backing up server configuration files
JSCAPE MFT Server has several configuration files that are used to store server details such as services, triggers, server keys and more. You should backup these files on a regular basis should emergency recovery be needed. These configuration files may also be used for mirroring configuration settings to other servers for the purposes of failover support. All configuration files are located in the installation directory of
JSCAPE MFT Server. These files are described below.
Filename certificates.dat
Description
Contains any client certificates created using the
Key Manager.
Chapter 3 Server configuration
Server configuration client.dat
email.dat
domains email_properties.dat
failover.dat
https.dat
jdbc.dat
keys.dat
license.lic
pub_keys.dat
pgp_keys.dat
host-certificates.dat
host-pubkeys.dat
security.dat
system.dat
security.cfg
sys_certs.dat
web.cfg
client.cfg
manager.cfg
jmx.cfg
ui.cfg
manager-web.cfg
ssl.cfg
client.vmoptions
server.vmoptions
3
Contains keys for client management connection.
Contains SMTP server connection settings for use in email.
Contains directory of information for all domains, including services, triggers, reverse proxies etc.
Contains email related properties.
Contains failover settings.
Contains SSL certificate information for HTTPS service.
Contains a list of JDBC driver class names to be registered at startup.
Contains server keys created using the Key
Manager.
Contains server license key.
Contains any public client keys created using the
Key Manager.
Contains any PGP keys created using the Key
Manager.
Contains any certificates listed in Host Keys tab of
Key Manager.
Contains any public keys listed in Host Keys tab of
Key Manager.
Contains security settings for administrative service.
Contains miscellaneous system information.
Contains list of security providers to be used.
Contains server certificates for HTTPS service.
Contains web server configuration details.
Contains client configuration for connecting to administrative service.
Contains server configuration for administrative service.
Contains server JMX configuration settings.
Contains user interface settings for JSCAPE MFT
Server Manager.
Contains settings for administrative web service.
Contains list of SSL providers to be used by your
JVM.
Contains various startup properties such as allocated heap memory for JSCAPE MFT Server Manager.
Contains various startup properties such as allocated heap memory for JSCAPE MFT Server.
To automatically backup your server configuration files on a scheduled basis, create a trigger using the
Current Time event and System Configuration Backup action.
Defining a failover server
JSCAPE MFT Server may be configured to synchronize all configuration changes to a failover server. The purpose of a failover server is that in the event the production server goes down the failover server can quickly take over the duties of the production server. To define a failover server go to Server >
Settings > Failover panel.
Figure 93
119 Chapter 3 Server configuration
Server configuration 3
Enable automatic failover synchronization - Check to enable automatic synchronization of configuration files to failover server upon any change on production server.
Host/IP - The hostname or IP address of the failover server.
Port - The port running the JSCAPE MFT Server Service on the failover server.
Timeout - The timeout for connecting to failover server.
Username - The JSCAPE MFT Server Service username for the failover server.
Password - The JSCAPE MFT Server Service password for the failover server.
Start domain/services after synchronization - Check to start domain and services on failover machine after synchronization.
Enable automatic failover server synchronization - Check to automatically synchronize configuration data to failover server when changes are made.
IP Substitution - IP mapping which replaces all Services matching specified IP with corresponding
Substitution IP during synchronization. This is useful in cases where the failover server needs a service to listen on a different IP than is used by the production server.
Failover considerations
There are a few things you must consider when defining a failover server in JSCAPE MFT Server Manager.
1. With failover mode enabled an active connection is maintained between the primary server and the administrative service of the failover server. This connection ensures that whenever configuration changes
120 Chapter 3 Server configuration
Server configuration 3 are made to primary server that they are automatically synchronized to failover server. In order to see the changes on failover server you may need to refresh data displayed in JSCAPE MFT Server Manager. This can be done by selecting the Home menu item.
2. Upon synchronization of data from primary server to failover server the domain and web services on failover server are NOT automatically started (unless the "Start domain/services after synchronization" is enabled). This is by design. The reasoning behind this is that in the event you are using database logs you may not want duplicate log information to be sent from failover server to database log whenever server configuration is updated. Therefore when switching to failover server you will need to first enable any web services in Server > Settings > Web section of JSCAPE MFT Server Manager and start the domain.
3. User directories and data are not copied during failover synchronization. This process should be managed by your SAN (Storage Area Network) or via manual synchronization.
If failover synchronization fails further synchronization may be disabled to prevent possible performance issues. You may identify this event by creating a trigger to capture the Failover Synchronization event and adding a condition to check whether the Success variable is equal to true. You may then add one or more actions to the trigger in order to respond to this condition e.g. Send Email.
On-demand synchronization
JSCAPE MFT Server also supports on-demand synchronization. This is slightly different than failover mode in that an active connection is not maintained between the source and destination server. This allows you to perform a one-time synchronization of server configuration files to destination server by clicking the
Synchronize State button. The Synchronize State button is enabled only when the Enable automatic failover synchronization checkbox is not checked.
On Demand v.s. Automatic Synchronization
As described above, on demand synchronization is performed when clicking the Synchronize State button. Automatic synchronization is performed when the Enable automatic failover server synchronization option is enabled. There are some important differences between the behavior of on demand v.s. automatic synchronization that should be noted.
1. When using on demand synchronization all domains on failover server are first deleted. Next, the production server copies all it's domains to the failover server. This is known as a full synchronization and ensures that both servers are running an exact copy.
2. When using automatic synchronization each event on the production server is sent to the failover server where it is processed. For example, if a user is added on the production server then this event is sent to the failover server where the user is also added, keeping the two servers in sync in real-time. This is known as a partial synchronization. This process is more efficient than doing a full on demand synchronization because only the changes made on the production server are synchronized rather than sending all production server configuration data.
Note, the synchronization process is one direction only, from production server to failover server. Changes made on the failover server are not automatically synchronized back to production server. If for some reason you must synchronize data from failover to production (e.g. you need to recover your production server after using failover server in production mode) then an on demand synchronization must be performed as follows:
1. Disable failover module on production server. This ensures that when performing on demand synchronization you do not create an endless synchronization loop.
121 Chapter 3 Server configuration
Server configuration
2. On failover server, enable failover synchronization setting failover server to production host.
3. On failover server, click the Synchronize State button to perform on demand synchronization.
3
4. On failover server, disable failover synchronization.
5. Load production server and verify that data has been synchronized correctly.
6. Enable failover module on production server setting failover server to failover host.
Defining password compliance
JSCAPE MFT Server may be configured to require that user passwords meet certain requirements. To configure password requirements, click on the Compliance node in JSCAPE MFT Server Manager.
Figure 106
Minimum password length of - Requires that password contain the minimum number of defined characters.
Maximum password age of - Requires that user passwords be changed before reaching maximum password age. This option can be overridden at the user level by enabling the Ignore password aging rules option.
Email password change reminder - Emails a password change reminder to the email address associated with user the defined number of days before password reaches maximum password age. To function correctly an SMTP server must be configured under Server > Settings > Email in JSCAPE MFT
Server Manager. Note, email reminders are sent daily, approximately 10 minutes after start of JSCAPE
MFT Server and every 24 hours thereafter.
122 Chapter 3 Server configuration
Server configuration 3
Password must not match previous - Requires that new passwords must not match the defined number of previous passwords.
Deny login for password non-compliance - If enabled, user password will be verified at time of login to check that it meets compliance requirements. If it matches user password but does not meet compliance requirements then user will be denied login.
Required characters - Passwords must contain the selected characters.
Adding trading partners
A trading partner is defined as a remote service that you want to regularly exchange data with. Trading partner information may be used in triggers when performing scheduled or event based file transfers. The purpose of the trading partner module is to centralize remote host credentials so that they can be reused within trigger actions. Used properly, if a remote host changes their hostname or credentials you only need to update the trading partner details rather than update all trigger actions that depend on this host.
To add a trading partner select the Trading Partners node within JSCAPE MFT Server Manager and click on the Add button.
Figure 142
Chapter 3 Server configuration
Figure 143
123
Server configuration 3
Basic
Name - A unique name to assign to this trading partner.
Company - The name of the company that this trading partner represents.
E-mail - The primary email address for this trading partner.
Server
Details vary based on the protocol selected.
124 Chapter 3 Server configuration
Server configuration 3
Using trading partners in triggers
There are a number of file transfer related trigger actions that can use trading partner credentials in their work. These include the following actions.
Trading Partner Create Directory
Trading Partner Delete Directory
Trading Partner Delete File
Trading Partner Directory Download
Trading Partner Directory Upload
Trading Partner File Download
Trading Partner File Upload
Trading Partner Rename File
See also
Monitoring server resources using JMX
The JMX service included with JSCAPE MFT Server allows you to more closely monitor usage of CPU and memory resources. It is meant to be used with a Java profiling application such as VisualVM.
Connecting via JMX
In order to connect via JMX you will need to provide a connection URL. Please use the format provided below.
service:jmx:rmi://[hostname]:[serverport]/jndi/rmi://[hostname]:
[registryport]/server where [hostname] and [port] are the hostname and port that JMX service is listening on. Note, if you are listening on host/IP 0.0.0.0 then you will need to replace the hostname in the URL with the actual IP address of the server. Also, it is important that when connecting remotely that both the Server port and Registry port are allowed inbound connections for any firewall.
JMX Credentials
To connect via JMX you must provide valid administrator credentials. Administrators for JSCAPE MFT
Server are defined in Server > Settings > Manager Service > Administrators in JSCAPE
MFT Server Manager.
Configuring JMX
The JMX service may be configured in Server > Settings > JMX in JSCAPE MFT Server Manager.
Figure 157
Chapter 3 Server configuration 125
Server configuration 3
Performing backups of server configuration data
It is recommended that you perform a regularly scheduled backup of your JSCAPE MFT Server configuration and user files. This may be performed using the System Configuration Backup action as part of a trigger.
Manual Backup
To perform a manual backup of JSCAPE MFT Server create a ZIP archive of the JSCAPE MFT Server installation directory. This archive may be used for disaster recovery purposes.
Automatic Backup
1. Using JSCAPE MFT Server Manager create a trigger that uses the Current Time event. When specifying the Condition use a time expression to set the time(s) of day that you would like the trigger to run.
2. When prompted to select the action, select the System Configuration Backup action and populate the required fields.
3. Click OK and Apply to save the trigger.
4. Select the trigger and click Run to verify that the backup archive is created successfully. This archive may be used for disaster recovery purposes.
Note, unlike the manual backup the System Configuration Backup action attempts to save space by only including necessary files in it's archive. The archive will include the following files
*.cfg
*.dat
*.vmoptions
*.lic
126 Chapter 3 Server configuration
Server configuration 3 and the following directories users domains relative to the installation directory specified in the System Configuration Backup trigger action.
Overview
AS2 (Applicability Statement 2) is a specification for sending messages securely and reliably using HTTP/
S. JSCAPE MFT Server provides support for both sending and receiving AS2 messages.
Enabling AS2
AS2 runs over HTTP/S. In order to enable AS2 you must first enable the HTTP/S service(s) in JSCAPE
MFT Server. See
Enabling web based file transfers
. To enable AS2 go to Server > Settings > Web
> AS2 panel in JSCAPE MFT Server Manager, check the Enable AS2 option and set the required parameters.
Figure 165
Enable AS2 - Check to enable receipt of AS2 messages.
Messages
Datastore Settings - Defines where AS2 messages are stored.
Decryption key - This is the private key that will be used to decrypt AS2 messages. This key is sourced from the Server Keys panel in Key Manager.
Receipt signing key - This is the private key that will be used to sign MDN receipts. This key is sourced from the Server Keys panel in Key Manager.
Chapter 3 Server configuration 127
AS2 (Applicability Statement 2) 4
Receipt signature algorithm - This is the message signing algorithm used when sending MDN receipts.
Encryption required - If checked all incoming AS2 messages must be encrypted.
Signature required - If checked all incoming AS2 messages must be signed.
Allow messages without filename - If checked incoming AS2 messages may optionally have a filename attribute. If no filename attribute is provided a unique timestamp based filename will be automatically generated. If unchecked AS2 messages must have a filename attribute.
Overwrite existing files when found - If checked and file already exists with matching filename attribute then file will be overwritten. If unchecked and file already exists AS2 message will be rejected.
Bind unauthenticated transfers to user - If checked, incoming AS2 messages that do not include user credentials will be mapped to the specified username and domain. If unchecked then all incoming AS2 messages must include user credentials.
Upload directory - The directory relative to users root directory where AS2 message data will be stored.
Receipt text - Additional information to include in AS2 receipts.
Receiving AS2 messages
In order to receive AS2 messages you must first enable the AS2 service. See
AS2 messages in JSCAPE MFT Server the sender may ask you for a number of parameters. A guide to these parameters has been provided below.
Parameters
URL http[s]://hostname[:port]/as2/incoming/ where hostname is the hostname or IP address and port is the port as set in Server > Settings > Web panel of JSCAPE MFT Server Manager.
e.g.
https://192.168.1.1:443/as2/incoming/
Username username@domain where username is the user Login and domain is the JSCAPE MFT Server domain to which the user belongs.
e.g.
test@localhost
Password
128 Chapter 4 AS2 (Applicability Statement 2)
AS2 (Applicability Statement 2)
The password for the specified username.
e.g.
secret
From ID
This can be any value that uniquely identifies where the AS2 message is coming from.
MyTradingPartner
To ID
This can be any value that uniquely identifies where the AS2 message is being sent to.
e.g.
JSCAPE
Encryption key
If message encryption is used then message should be encrypted with recipients public key.
Signing key
If message signing is used then message should be signed with senders private key.
MDN receipt
Both synchronous and asynchronous modes are supported.
4
Processing AS2 messages
As AS2 messages are received they will be processed according to the settings in the Server >
Settings > Web > AS2 panel. AS2 message data will be stored in the Upload directory (See
Server > Settings > Web > AS2 ) relative to users root directory. A history of all AS2 messages can be seen in the AS2 Messages module for your domain.
Sending AS2 messages
In order to send an AS2 message you must first create an AS2 trading partner. See
. See Figure 166 below for an example AS2 trading partner. In this example the trading partner is another instance of JSCAPE MFT Server. AS2 messages may be sent manually from the AS2
Messages module or automatically in response to server events using the Triggers module and related actions.
Creating an AS2 Trading Partner
Figure 166
Chapter 4 AS2 (Applicability Statement 2) 129
AS2 (Applicability Statement 2) 4
Connection
URL - The URL of AS2 HTTP/S service.
Timeout - The timeout in seconds for establishing a connection to AS2 service.
Username - The optional username to use when logging into AS2 service. Note, when connecting to an instance of JSCAPE MFT Server running AS2 service you must provide credentials with username in the form of username@domain. Credentials will be submitted using HTTP basic authentication.
Password - The optional password to use when logging into AS2 service.
SSL
Host key - The host key to use when validating HTTPS certificate of server. This key is sourced from Host
130 Chapter 4 AS2 (Applicability Statement 2)
AS2 (Applicability Statement 2)
Keys tab in Key Manager.
Client key - The client key to use when authenticating with HTTPS server.
Message
From ID - This can be any alpha-numeric value (no spaces) that uniquely identifies where the AS2 message is coming from.
4
To ID - This can be any alpha-numeric value (no spaces) that uniquely identifies where the AS2 message is being sent to.
Receipt - The method of MDN receipt. Both synchronous and asynchronous modes are supported. In synchronous mode JSCAPE MFT Server will send the AS2 message and read the MDN receipt in a single connection. In asynchronous mode JSCAPE MFT Server will send the AS2 message along with instructions to the recipient on where to send the MDN receipt once the AS2 message is processed.
Asynchronous MDN receipts are sent to JSCAPE MFT Server over HTTP/S via the URL http(s)://
[host]:[port]/as2/receipts where [host] and [port] are the IP address and port that the
JSCAPE MFT Server AS2 service is listening on. * Note, when using asynchronous mode it is important that the IP address that your AS2 service is listening on is publicly available. If for example you are using the special address 0.0.0.0 or an internal NAT address then you will need to instruct JSCAPE MFT
Server to use a different address when sending out asynchronous MDN URL, otherwise the recipient may not be able to post the MDN receipt. This can be achieved in Server > Settings > Web >
Miscellaneous > Server name , setting this value to the public IP address or hostname of your
JSCAPE MFT Server instance.
Prefer HTTPS receipt delivery URL - If checked (default) then the URL provided for asynchronous MDN receipts will use HTTPS service if available.
Receipt signature required - If checked then recipient must respond with an MDN receipt.
Receipt timeout - The timeout for receiving an MDN receipt. This applies to synchronous mode only.
Encryption key - The public key/certificate to use for encrypting AS2 messages. This is sourced from Host
Keys panel in Key Manager.
Encryption algorithm - The encryption algorithm used for encrypting AS2 messages.
Signing key - The private key to use for signing AS2 messages. This is sourced from Server Keys panel in
Key Manager.
Signature algorithm - The algorithm used for signing AS2 messages.
Enable compression - If checked AS2 messages will be sent compressed.
Sending an AS2 message manually
To send an AS2 message manually go to the AS2 Messages module for your domain and click the "Send
File" button. You will be prompted for the file and AS2 trading partner to send the message to.
Figure 167
131 Chapter 4 AS2 (Applicability Statement 2)
AS2 (Applicability Statement 2) 4
Trading partner - The AS2 trading partner to send file to.
File - The file to send.
Sending an AS2 message automatically
You can send an AS2 message automatically in response to server events using the Triggers module and the Trading Partner File Upload or Trading Partner Regex File Upload actions.
See
Resending an AS2 message
To manually resend an AS2 message, select the desired message from the AS2 Messages module and click the Resend button. Note, only messages of type request may be resent.
Viewing AS2 messages
A history of all AS2 messages sent and received for a domain can be found in the AS2 Messages module in JSCAPE MFT Server Manager.
Figure 168
132 Chapter 4 AS2 (Applicability Statement 2)
AS2 (Applicability Statement 2) 4
View AS2 message details
To view the details of any AS2 message, select the desired message and click the View button.
Figure 169
Deleting AS2 messages
You may wish to delete/purge AS2 messages from your system in order to save storage space. To do so, select the desired messages you wish to delete (hold shift key to select multiple message) and click the
Delete button. A confirmation dialog will be displayed asking you to confirm deletion.
Figure 170
Chapter 4 AS2 (Applicability Statement 2) 133
AS2 (Applicability Statement 2) 4
Overview
Triggers are a very powerful feature that allow you to listen for events and respond with actions if conditions are met. For example, whenever a file is uploaded by a certain user you may wish to have this file
OpenPGP encrypted and then have an email notification sent to another user within your organization with the details of this upload.
Example Uses
Automate routine file transfer tasks.
Email notification of key events.
Automate OpenPGP encryption/decryption of transferred files.
Automate compression/decompression of transferred files.
See also
Manually executing time based triggers
134 Chapter 4 AS2 (Applicability Statement 2)
Trigger management 5
Trigger lifecycle
To benefit fully from the use of triggers you may find it helpful to understand the lifecycle of a trigger. This is explained below.
1. Raise event
The first step in trigger lifecycle starts with an event. There are a number of events that can be listened for in a trigger. Examples of these are provided below.
Current Time
This event is automatically raised every minute and can be used for scheduling triggers.
File Upload
This event is raised anytime a file is uploaded via on of the file transfer services provided by the server.
User Login
This event is raised anytime a user attempts to login to the server.
For a complete list of available events please see the Event type field when adding or editing a trigger.
2. Identify matching triggers
The next step in the trigger lifecycle is to identify those enabled triggers that are listening for the event type raised. For example, in the case where a File Upload event is fired all triggers listening for the File
Upload event will be identified.
3. Filter trigger conditions
Next in the trigger lifecycle is to filter those matching triggers even further, excluding those that do not match trigger conditions that may have been specified. To explain, each event has a set of properties that are set when the event is raised. These properties can be accessed in trigger conditions and trigger actions using event variables. For example, a trigger may choose to listen only for File Upload events where the login of the user that uploaded the file matches a specific value.
Example Condition
Username = "test"
Note, each event has different event variables available to it. For example, the File Upload event has a
LocalPath variable that may be used to identify the absolute path of the file uploaded. This variable however is not available in the User Login event.
To see what variables are available for each event type please use the Variables button when adding a
Chapter 5 Trigger management 135
Trigger management 5 condition or the Add Variable button when adding an action to a trigger.
See also
4. Prepare for execution
Now that triggers have been identified and filtered, the next step is to prepare for the execution of those triggers.
Each trigger may be executed in asynchronous (concurrently) or synchronous (sequentially) mode depending on the settings for the individual trigger. At this point in the lifecycle, these triggers are split into two separate queues, one for asynchronous triggers and another for synchronous triggers. Those triggers in the asynchronous queue are executed first, followed by those in the synchronous queue. Those triggers in the synchronous queue are executed in the order they are defined in the Triggers module of JSCAPE
MFT Server. The order of execution for synchronous triggers can be controlled using the Up and Down buttons with those triggers located at the top taking priority.
Note, depending on the optional settings in the Triggers > Settings panel of JSCAPE MFT Server you may limit the number of triggers that will execute concurrently. Those triggers that are waiting to be executed will have a status of pending in the Triggers > Recent panel of JSCAPE MFT Server.
5. Execute trigger
For each trigger there are one (1) or more actions to execute. These actions are executed in sequence.
In the event that an action fails a Trigger Error event is raised and subsequent actions will not be executed. To listen for these errors a separate trigger that listens for the Trigger Error event may be used. Triggers that fail execution will have a status of failed in the Triggers > Recent panel of
JSCAPE MFT Server.
Triggers that successfully execute will have a status of completed in the Triggers > Recent panel of
JSCAPE MFT Server.
6. Log results
The full lifecycle of a trigger is written to the server log for historical and auditing purposes. You may also view the status of the most recent one thousand (1000) triggers in the Triggers > Recent panel of
JSCAPE MFT Server.
Adding triggers
A trigger is a method of listening for events and responding with actions based on whether conditions are met. To view a list of triggers click on the Triggers node for the desired domain.
Figure 34
136 Chapter 5 Trigger management
Trigger management 5
To add a trigger click on the Add button in the lower right corner. The Add Trigger wizard will be displayed.
Figure 35
Name - A unique name identifying this trigger.
Event Type - The type of event you want to listen for.
Description - Description of this trigger.
Chapter 5 Trigger management 137
Trigger management 5
Enabled - Enables/disables trigger.
Fire Trigger Error event if error occurs - If an error occurs while executing any of the actions associated with this trigger, a Trigger Error event will be raised. You may capture this event using a trigger that listens for the Trigger Error event and respond appropriately.
Figure 36
Figure 37
138 Chapter 5 Trigger management
Trigger management 5
See also
Settings
There are various settings that control how triggers are executed. These are defined in the Triggers >
Settings panel in JSCAPE MFT Server Manager.
Limiting number of concurrent triggers
Limiting number of concurrent transfers
Figure 139
Chapter 5 Trigger management 139
Trigger management 5
Limiting number of concurrent triggers
You may wish to limit the number of concurrent triggers that are running in JSCAPE MFT Server. Since each trigger and it's associated actions take up a portion of memory and CPU this is useful in cases where many triggers could be running simultaneously causing your server to be overloaded. To prevent this you can optionally set the maximum number of concurrent triggers. If the maximum number of concurrent triggers is reached then triggers will be placed in a queue for later execution. If the size of the queue is exceeded then an error message will be written to the server activity log.
Limiting number of concurrent transfers
You may wish to limit the number of concurrent file transfer related trigger actions that are running in
JSCAPE MFT Server. Since each file transfer related trigger action takes up a portion of bandwidth and disk I/O this is useful in cases where many file transfer triggers could be running simultaneously causing your server to be overloaded. To prevent this you can optionally set the maximum number of concurrent file transfers. If the maximum number of concurrent file transfers is reached then file transfer triggers actions will be placed in a queue for later execution, or depending on the trigger action priority they may interrupt an existing file transfer action and be given execution priority. Interrupted file transfer actions will automatically resume upon completion of higher priority file transfer actions. If the size of the queue is exceeded then an error message will be written to the server activity log.
140
Defining global variables
You may wish to define global event variables that can be used by all of your triggers. Once created these global variables can be accessed from any of your trigger actions using the Add Variable button.
Using time based triggers
JSCAPE MFT Server includes a powerful scheduler which allows you to schedule actions for execution on a one-time-only or recurring basis. To setup a time based trigger create a new Trigger with an Event type of Current Time. The Current Time event is fired every one (1) minute while the server is running. Using one or more Trigger Condition(s) you can specify when the actions associated with a trigger should be executed. The example condition below in Figure 77 would be valid for 5:00 AM.
Chapter 5 Trigger management
Trigger management
Figure 57
5
Figure 77
See also
Chapter 5 Trigger management 141
Trigger management
5
Manually executing time based triggers
Triggers that use the Current Time event may be executed manually. To manually execute a Current
Time trigger select the trigger in the Triggers panel and click the Run button. The trigger will be immediately executed ignoring any Current Time event conditions.
Figure 130
Writing conditions
Trigger conditions are defined as a logical expression used to filter events based on event properties. An expression consists of zero (0) or more statements with each statement having a variable, operator and constant. Multiple statements may be joined together using AND or OR clauses to form complex expressions. Parenthesis may be used to set statement precedence. If the condition is left blank then the trigger actions will be executed anytime the trigger event is fired.
Example
(Hour = 5 AND Minute = 0) OR (Hour = 22 AND Minute = 30)
The above expression is true at 5:00 AM or 10:30 PM.
Testing conditions
Prior to deploying a trigger you may wish to test your conditions against sample data to see if the condition logic functions as expected. To test a condition go to Step 2 of adding or editing a trigger and click on the
Test Expression button. At this point you may enter sample data to test against the condition. Upon clicking Test a dialog will be displayed indicating the success or failure of the test.
Figure 56
142 Chapter 5 Trigger management
Trigger management 5
Event types
There are several event types that you may listen for when defining triggers. For a list of event types please see the context sensitive help available in JSCAPE MFT Server Manager when creating a trigger.
See also
Action types
There are several built-in action types that you may use when defining triggers. For a list of available actions please see the context sensitive help available in JSCAPE MFT Server Manager when creating a trigger.
See also
Chapter 5 Trigger management 143
144
Trigger management 5
Function types
There are several built in functions that you can use within trigger action fields. These functions are particularly useful in cases where you want to format or parse a trigger event variable. For a list of available functions please see the context sensitive help available in JSCAPE MFT Server Manager when creating a trigger.
Using event variables within functions
Using patterns in Format function
Rules for function arguments
1. Function parameters are separated by the comma character ,. Leading or trailing spaces are considered as the part of parameter.
2. Function parameter string data may be surrounded with quotes. If the function parameter is not surrounded by quotes then any leading or trailing spaces will be included as part of the parameter.
3. If the function parameter contains a comma then you must surround the parameter with quotes to prevent it from being misinterpreted as a parameter separator.
4. If you are nesting a function or variable within a function then you should omit the leading and trailing % symbols. e.g. %LocalDir%\%ToUpperCase(Name)%.RENAMED In this case the leading and trailing % symbol from the Name variable is removed.
Using event variables within functions
Each trigger listens for a server event which in turn has several event variables that you can use in your trigger actions when executed. These event variables may be used in functions as well. For example, let's assume you are listening for the File Upload event and you want to rename the file to an upper case version of it's filename with a .RENAMED file extension. To achieve this you would create a trigger that listens for File Upload event and executes a Rename File action. The Rename File action has two required fields, File and Destination File, which would be as follows:
File: %LocalPath%
Destination File: %LocalDir%\%ToUpperCase(Name)%.RENAMED
In this case the ToUpperCase function is used, it's argument being the name of the file uploaded as represented by the Name event variable.
Using patterns in Format function
The Format function is very powerful in that it allows you to format data in a language neutral way. The most common use is in the formatting of dates. For example, assume that you need to get numeric month and day of month values in the format MM-DD. To achieve this you could use the Month and
DayOfMonth event variables. The problem however is that the Month and DayOfMonth event variables return integer values, not strings, returning the incorrect format for months and days whose values fall between 1 and 9. To resolve this issue you must use the Format function to format the Month and
DayOfMonth values in the desired format. The example below demonstrates how a MM-DD format could be achieved.
Chapter 5 Trigger management
Trigger management 5
%Format("{0,number,00}-{1,number,00}",Month,DayOfMonth)%
The Format function uses the java.text.MessageFormat class that is provided as part of the JDK.
For more information on how patterns may be used, please consult the JavaDoc documentation for this class available at:
http://docs.oracle.com/javase/6/docs/api/java/text/MessageFormat.html
Defining custom action types
You may define your own custom actions using the JSCAPE MFT Server Java Management API classes.
To write your own action class extend the com.jscape.inet.mft.workflow.AbstractAction
class and implement the abstract execute() method to perform the work of your action. Below is an example implementation of the AbstractAction class. This example prints a message to
System.out
and the log datastore.
JSCAPE MFT Server Manager uses Java reflection to build the GUI dialogs used to collect action properties. Therefore, all properties of your action should have corresponding getter/setter methods using
Java naming conventions and an empty argument constructor for constructing the action. Using the
PropertyDescriptor[] property you can define the order of properties and whether they are required.
The resultMessage property is the message that will be written to the log file upon executing the action.
Note
Action properties may consist only of Java primitive values e.g. String, int, boolean etc.
For actions to be made available you must create a JAR archive e.g. myactions.jar, that contains your actions and place it in the libs/actions directory of your JSCAPE MFT Server installation. Any third party libraries that your action depends on should be placed in the libs directory of your JSCAPE MFT
Server installation. For your action to be recognized by JSCAPE MFT Server restart the JSCAPE MFT
Server Service.
Example
For a tutorial and complete source code example please see the following: http://blog.jscape.com/jscape/2008/11/jscape-secure-f.html
See also
145 Chapter 5 Trigger management
146
Trigger management 5
File Transfer Script Language
The File Transfer Script Language is a very basic scripting language that allows you to automate routine file transfer processes. This language may be used when defining a File Transfer Script action as part of trigger.
The following commands may be used in a script file when invoking File Transfer Command Line.
deldir disconnect exec get getdir
msg prompt promptmask put putdir
set aftpcompression set aftpcompressionfilesize set aftpcompressionexclude set aftpcongestioncontrol
set aftpdownloadrate set aftpsecurity set aftpuploadrate set debug set hostname
set logfile set passive set password set protocol
set port set privatekey set secure set timeout set username
Chapter 5 Trigger management
Trigger management 5
The above commands are reserved words in the FTCL language and may not be used as variable names when using the s et or pr ompt commands.
Example
Bad pr ompt di r " Ent er di r ec t or y name: "
The variable named " di r " may not be used as this is a reserved word for use by the " di r " command used to get a directory listing.
Good pr ompt my di r " Ent er di r ec t or y name: "
The variable named " my di r " is not a reserved word so may be used.
a p p e n d " <f i l e>" [ " <des t i nat i on>" ] Appends contents of local file to remote file with same name.
<f i l e> a quoted relative filename or absolute path
<des t i nat i on> optional quoted remote filename to append to c d " <di r ec t or y >" c o n n e c t d e l " <f i l e>"
Example append " l og. t x t " " my l og. t x t "
Example append " l og. t x t "
Sets directory on remote server.
<di r ec t or y > a quoted relative directory name or absolute path
Example c d " j s mi t h"
Example c d " / home/ us er s / j s mi t h"
Establishes connection with remote server.
Deletes remote filename.
<f i l e> a quoted relative filename or absolute path
Chapter 5 Trigger management 147
Trigger management d e l d i r " <di r ec t or y >" d i s c o n n e c t e x e c " <c ommand> " g e t " <f i l e>" g e t d i r " <di r ec t or y >"
5
Example del " l ogs . t x t "
Example del " / home/ us er / l ogs . t x t "
Deletes remote directory recursively
<di r ec t or y > a quoted relative directory name or absolute path
Example del di r " l ogs "
Example del di r " / home/ us er s / j s mi t h/ l ogs "
Disconnects from remote server.
Executes command on local machine.
<c ommand> valid command to be interpreted by the local operating system.
Example ex ec " di r c : / t mp > c : / t mp/ di r out . t x t "
See also
Downloads file from remote server.
<f i l e> a quoted relative filename or absolute path
Example get " l ogs . t x t "
Downloads directory recursively from remote server.
<di r ec t or y > a quoted relative directory name or absolute path
Example get di r " l ogs "
Example
148 Chapter 5 Trigger management
Trigger management l c d " <di r ec t or y >" l c o p y " <pat h>" " <des t i nat i on>" l d e l " <f i l e>" l d e l d i r " <di r ec t or y >"
Chapter 5 Trigger management
5 get di r " / v ar / l ogs "
Sets current working directory on local machine. This directory is used when uploading files using relative paths and when downloading files.
<di r ec t or y > a quoted absolute path
Example l c d " c : / t mp"
See also
Copies a local file to a local destination.
<pat h> a quoted relative or absolute file or directory path
<des t i nat i on> a quoted relative or absolute file or directory path
Example l c opy " l ogs . t x t " " l ogs . t x t . ol d"
Example l c opy " c : / t mp/ l ogs . t x t " " c : / t mp/ l ogs . t x t . ol d"
See also
Deletes local filename.
<f i l e> a quoted relative filename or absolute path
Example l del " l ogs . t x t "
Example l del " c : / t mp/ l ogs . t x t "
See also
Deletes local directory recursively
149
Trigger management l mk d i r " <di r ec t or y >" l mo v e " <pat h>" " <des t i nat i on>" l r e n a me " <pat h>" " <des t i nat i on>"
150 Chapter 5 Trigger management
5
<di r ec t or y > a quoted relative directory name or absolute path
Example l del di r " t mp"
Example l del di r " c : / t mp"
See also
Creates local directory recursively
<di r ec t or y > a quoted relative directory name or absolute path
Example l mk di r " t mp"
Example l mk di r " c : / t mp"
See also
Moves a local file to a local destination.
<pat h> a quoted relative or absolute file or directory path
<des t i nat i on> a quoted relative or absolute file or directory path
Example mov e " l ogs . t x t " " ar c hi v e/ l ogs . t x t "
Example mov e " c : / t mp/ l ogs . t x t " " c : / t mp/ ar c hi v e/ l ogs . t x t "
See also
Renames file on local machine.
Trigger management mg e t " <f i l t er >" mk d i r " <di r ec t or y >" mo d e " <mode>" mp u t " <f i l t er >"
5
<pat h> a quoted relative or absolute file or directory path
<des t i nat i on> a quoted relative or absolute file or directory path
Example l r ename " l ogs . t x t " " l ogs . t x t . ol d"
Example l r ename " c : / t mp/ l ogs . t x t " " c : / t mp/ l ogs . t x t . ol d"
See also
Downloads files from current remote directory matching filter.
<f i l t er > a quoted regular expression
Example mget " . * \ \ . t x t "
Creates directory on remote server.
<di r ec t or y > a quoted relative directory name or absolute path
Example c d " j s mi t h"
Example c d " / home/ us er s / j s mi t h"
Sets transfer mode to ASCII or binary.
<mode> a quoted transfer mode of "ascii" or "binary"
Example mode " as c i i "
Uploads local files in current working directory matching filter to remote server.
<f i l t er >
Chapter 5 Trigger management 151
Trigger management ms g " <mes s age> "
5 a quoted regular expression
Example mput " . * \ \ . t x t "
Sends message to current debugging stream. By default the console is the current debug stream and debugging is enabled.
p r o mp t <v ar i abl ename> " <pr ompt >"
Example ms g " c onnec t i ng t o FTP s er v er "
Prompts user to enter a value to be read from the command line and stores this value in the variable name used in the first argument. The value stored in this variable is then available for use later in the script.
Example pr ompt us er name " Ent er us er name: " p r o mp t ma s k <v ar i abl ename> " <pr ompt >" Prompts user to enter a value to be read from the command line and stores this value in the variable name used in the first argument. The value stored in this variable is then available for use later in the script. Value entered is masked to user. p u t " <f i l e>" [ " <des t i nat i on>" ]
Example pr ompt mas k pas s wor d " Ent er pas s wor d: "
Uploads local file to remote server.
<f i l e> a quoted relative filename or absolute path
<des t i nat i on> optional quoted remote filename or absolute path to store file as p u t d i r " <di r ec t or y >"
Example put " c : / t mp/ l ogs . t x t "
Example put " c : / t mp/ l ogs . t x t " " my l ogs . t x t "
See also
Uploads local directory recursively to remote server.
<di r ec t or y >
152 Chapter 5 Trigger management
Trigger management r e n a me " <pat h>" " <des t i nat i on>" s e t <v ar i abl ename> <v al ue>
Chapter 5 Trigger management
5 a quoted relative directory name or absolute path
Example put di r " l ogs "
Example put di r " c : / t mp/ l ogs "
See also
Renames file on remote server.
<pat h> a quoted relative or absolute file or directory path
<des t i nat i on> a quoted relative or absolute file or directory path
Example r ename " l ogs . t x t " " l ogs . t x t . ol d"
Example r ename " / v ar / l ogs / l ogs . t x t " " / v ar / l ogs / l ogs . t x t . ol d"
Creates a user defined variable for use within a script.
<v ar i abl ename>
A variable name used to reference the variable. Must begin with a letter, and may be followed by 0 or more letters or digits.
<v al ue>
The value the variable name represents. Valid values include boolean values of true or false, any valid integer or any quoted string.
Example s et my Number Var i abl e 12
Example s et my Bool eanVar i abl e t r ue
Example s et my St r i ngVar i abl e " t es t i ng 1. 2. 3"
153
Trigger management 5 s e t a f t p c o mp r e s s i o n <bool ean>
Variables created may later be referenced using the
${<variablename>} notation.
Example s et my Number Var i abl e 12 ms g " v al ue of my Number Var i abl e i s :
{ my Number Var i abl e} "
Specifies whether streaming compression is enabled or disabled in AFTP connections. By default compression is enabled.
<bool ean> true, false s e t a f t p c o mp r e s s i o n f i l e s i z e
<f i l es i z e>
Example s et af t pc ompr es s i on f al s e
Specifies the minimum filesize in bytes for compression to be used in AFTP connections. The default minimum filesize is 10485760 (10MB).
<f i l es i z e>
A valid integer between 1-2,147,483,647 s e t a f t p c o mp r e s s i o n e x c l u d e
" <f i l t er >"
Example s et af t pc ompr es s i onf i l es i z e 100000
Specifies a case-insensitive, comma-delimited list of file extensions to exclude when using compression in AFTP connections. Default value is:
".bz2,.F,.gz,.lz,.lzma,.lzo,.rz,.sfark,.xz,.z,.Z,.infl,.7z,
.s7z,.ace,.afa,.alz,.apk,.arc,.arj,.ba,.bh,.cab,.cfs,
.cpt,.dar,.dd,.dgc,.dmg,.gca,.ha,.hki,.ice,.j,.kgb,.lzh,
.lha,.lzx,.pak,.partimg,.paq6,.paq7,.paq8,.pea,.pim,
.pit,.qda,.rar,.rk,.sda,.sea,.sen,.sfx,.sit,.sitx,.sqx,
.tgz,.tbz2,.tlz,.uc,.uc0,.uc2,.ucn,.ur2,.ue2,.uca,.uha,
.wim,.xar,.xp3,.yz1,.zip,.zipx,.zoo,.zz,"
<f i l t er > a comma-delimited list of file extensions.
Example s et af t pc ompr es s i onex c l ude " . z i p, . gz " s e t a f t p c o n g e s t i o n c o n t r o l <bool ean> Specifies whether congestion control is enabled or disabled when connecting using AFTP protocol. By default congestion control is enabled.
<bool ean>
154 Chapter 5 Trigger management
Trigger management s e t a f t p d o wn l o a d r a t e <bi t r at e> s e t a f t p s e c u r i t y " <mode>" s e t a f t p u p l o a d r a t e <bi t r at e> s e t d e b u g <bool ean> s e t h o s t n a me " <hos t name>"
Chapter 5 Trigger management
5 true, false
Example s et af t pc onges t i onc ont r ol f al s e
Specifies the download rate in Kbits per second. The default rate is 45000 Kbps.
<bi t r at e>
A valid integer between 1-2,147,483,647
Example s et af t pdownl oadr at e 100000
Specifies whether credentials and/or data are protected during an AFTP session. Default value is
"none" providing no protection.
<mode> a valid security mode. Valid values are "none",
"credentials & data", "credentials only".
Example s et af t ps ec ur i t y " c r edent i al s onl y "
Specifies the upload rate in Kbits per second. The default rate is 45000 Kbps.
<bi t r at e>
A valid integer between 1-2,147,483,647
Example s et af t pdownl oadr at e 100000
Specifies whether debugging is enabled or disabled.
By default debugging is enabled and all debugging information is sent to the console.
<bool ean> true, false
Example s et debug f al s e
Specified the hostname of the remote server.
<hos t name> a valid quoted hostname or IP address
Example s et hos t name " 192. 168. 10. 2"
155
Trigger management s e t l o g f i l e " <f i l e>" s e t p a s s i v e <bool ean> s e t p a s s wo r d " <pas s wor d>" s e t p r o t o c o l <pr ot oc ol >
5
Specifies the path of the log file to write debug data to. By default all output is sent to the console.
<f i l e> a valid relative or absolute file path on local machine
Example s et l ogf i l e " c : / t mp/ l og. t x t "
See also
Specifies whether passive or active mode should be used in FTP/S protocols. Default is true.
<bool ean> true, false
Example s et pas s i v e t r ue
Specifies the password to use when logging into the remote server.
<pas s wor d> a valid quoted password for specified username on remote server
Example s et pas s wor d " s ec r et "
Specifies the protocol to use when establishing a connection.
<pr ot oc ol > the protocol to use. Valid options are "ftp", "ftps",
"ftps-auth-tls", "ftps-auth-ssl", "ftps-implicit", "sftp" and "aftp" for the protocols FTP, FTP over SSL
(AUTH SSL), FTP over SSL (Implicit SSL), SFTP
(FTP over SSH) and AFTP respectively. Default protocol is "ftp"
Note
When using "ftps-implicit" setting you must set the port to the server port responsible for handling implicit
SSL connections. This is typically handled on port 990.
Example
156 Chapter 5 Trigger management
Trigger management s e t p o r t <por t > s e t p r i v a t e k e y " <f i l e>" s e t s e c u r e <bool ean> s e t t i me o u t <s ec onds > s e t u s e r n a me " <us er name>"
Chapter 5 Trigger management
5 s et pr ot oc ol " f t ps - aut h- t l s "
See also
Specifies the port of the remote server. The default ports for FTP and SFTP protocols are 21 and 22 respectively.
<por t >
A valid integer between 1-65535
Example s et por t 2021
Specifies the path of private key file to use when authenticating with SFTP server. Valid for use in
SFTP protocol only.
<f i l e> a valid relative or absolute file path on local machine
Example s et pr i v at ek ey " c : / s s h/ k ey s / i d_ds a"
Specifies that the secure SFTP protocol be used.
FTP protocol is used by default. Requires that SSH version 2.0 or above be installed on remote server and SFTP be enabled.
<bool ean> true, false
Example s et s ec ur e t r ue
Sets the maximum timeout used when establishing a connection, sending data or receiving data. If timeout is exceeded script will abort. Default value is 60 seconds.
<s ec onds > the maximum number of seconds to wait
Example s et t i meout 30
Specifies the username to use when logging into the remote server.
<us er name>
157
Trigger management 5 s e t wi r e e n c o d i n g " <enc odi ng>" wa i t <s ec onds > a valid quoted username for remote server
Example s et us er name " j s mi t h"
Specifies the wire encoding to use on command channel for FTP/S protocols.
<enc odi ng> a valid quoted character encoding
Example s et wi r eenc odi ng " UTF- 8"
Pauses execution of script for specified number of seconds.
<s ec onds > the number of seconds to wait
Example wai t 5
Escape sequences
The FTCL language allows for the use of escape characters when defining strings in the same way that the
Java programming language does. The \ character is treated specially inside of strings indicating that the next character is to be escaped.
Escape sequences
Escape sequence
\ t
\ r
\ n
\ \
\ "
Description
Tab
Carriage return
Line feed
Backslash
Quote
Note
This is especially important to consider when defining local paths on the Windows operating system. The local path c:\tmp must be defined as c:/tmp or c:\\tmp when using FTCL commands that use local path information.
Example
Incorrect l c d " c : \ t mp\ home"
Correct
158 Chapter 5 Trigger management
Trigger management 5 l c d " c : / t mp/ home"
The first example is incorrect as the " \ t " in " c : \ t mp\ home" would be interpreted by FTCL as a tab character instead of a literal \ t . The second example corrects this issue by using a forward slash instead of a backslash.
Overview
JSCAPE MFT Server Web Gateway is a web based file transfer client. It has many of the functions of traditional FTP/SFTP clients providing the ability to manage, upload and download files from a remote server. However, unlike traditional FTP/SFTP clients, as a browser based platform-independent application there is no software to install or maintain drastically reducing the total cost of ownership. Additionally, since JSCAPE MFT Server Web Gateway runs over HTTP/S it bypasses many firewall restrictions while still maintaining the highest level of security.
See also
Enabling web based file transfers
Enabling web based file transfers
JSCAPE MFT Server includes JSCAPE MFT Server Web Gateway, a browser based file transfer client for performing file transfer sessions with JSCAPE MFT Server.
JSCAPE MFT Server Web Gateway has all the common functions of a file transfer client without having to go through the trouble and expense of installing file transfer client software on your end-users computers.
Additionally, since JSCAPE MFT Server Web Gateway communicates via HTTP/S, you can easily give your users secure file transfer capabilities without having to deal with complex customer firewall issues often associated with FTP/SFTP protocols.
Step 1. - Enable HTTP/S services
Go to the Server > Settings > Web node . Here you will find a set of options for enabling HTTP/S services.
Figure 19
Chapter 5 Trigger management 159
W eb based file transfers 6
Web Server
HTTP on host - The host and port you want to enable HTTP service on. This will also be used for client
REST services.
HTTPS on host - The host and port you want to enable HTTPS service on. This will also be used for client
REST services.
HTTPS
Private key - The SSL encryption key to be used for HTTPS services.
Redirect HTTP requests to HTTPS - Automatically redirects HTTP requests to HTTP.
HTTPS client certificate required - Requires that client browser successfully identify itself with a client certificate found in "Client keys" section of Key Manager.
SSL/TLS negotiation allowed - If enabled clients will be allowed to renegotiate SSL/TLS sessions.
SSL/TLS Ciphers - List of enabled SSL ciphers for HTTPS communications.
Miscellaneous
User interface - Sets what user interface options are available from login page.
Default domain - Defaults domain field to specified value when logging in via web interface.
Server name - Optional value if entered will replace any HTTP headers that contain hostname data with specified hostname. This is useful in cases where server operates behind a NAT enabled firewall and you do not want to leak internal hostname or IP address information.
160 Chapter 6 Web based file transfers
W eb based file transfers 6
Session timeout - The amount of time after which to close inactive HTTP/S sessions.
Hide domain - Hides domain field when logging in via web interface. If this option is checked then a default domain MUST be provided.
Show domain dropdown - If enabled a drop-down of all available domains is displayed for the Domain field when logging in via the web interface, otherwise a text field is displayed requiring user to type in domain.
Redirect HTTP to HTTPS - Redirect incoming HTTP requests to secure HTTPS service.
Show lost password link - If enabled the Lost password link will be displayed on web interface login page allowing user to reset their password via email.
See also
Obtaining a trusted certificate
Step 2. - Add HTTP/S services to your Domain.
For the desired domain go to the Services module and click the Add button. When prompted set the
Protocol to HTTP/S and select the desired protocols you wish to accept file transfers for.
Figure 33
See also
Obtaining a trusted certificate
Chapter 6 Web based file transfers 161
W eb based file transfers 6
Web user interface
JSCAPE MFT Server Web Gateway has all the common functions of a file transfer client without having to install file transfer client software on your end-users computers. All user permissions and virtual paths are observed when using JSCAPE MFT Server Web Gateway.
Figure 25
Domain - The name of the domain to connect to. This is the name of the domain as identified Domain
Name column of JSCAPE MFT Server Manager, not the IP address or hostname although these may be the same.
Username - The account username.
Password - The account password.
User Interface - The user interface to show upon login. Java Applet user interface is only supported in
Enterprise version of JSCAPE MFT Server and only if WebDAV service is enabled for domain.
Lost password - Allows user to reset lost password.
Figure 32
162 Chapter 6 Web based file transfers
W eb based file transfers 6
Figure 115
Chapter 6 Web based file transfers 163
W eb based file transfers 6
Personal Information
This section is available to all users and may be used to update the name, email address and password for a user account.
Public Key Authentication
This section can be used to generate a key pair for use in public key authentication (SFTP). When generating a key pair or importing a public key the public key is automatically placed in the .ssh/ key.pub
file relative to the users root login directory on the server. When generating a key pair the user is prompted to store the private key on their system. Note, private keys should never be stored on the server, except for purposes of connecting to other remote servers.
OpenPGP Encryption
This section can be used to generate an OpenPGP key pair for use in encrypting files uploaded to virtual directories.
Domain Administration
This section is only available to domain administrators and may be used to manage users.
164 Chapter 6 Web based file transfers
W eb based file transfers 6
Quotas
This section displays any bandwidth quota or directory monitor quota information for the user.
Contacts
This section can be used to manage contacts for use in ad-hoc file transfers.
Activity
This section can be used to manage ad-hoc emails sent by the user.
Drop Zones
This section shows drop zone information for the user.
See also
Assigning domain administrators
Customizing the web interface
The JSCAPE MFT Server Web Gateway user interface may be easily customized to match the language and look and feel of your organization.
Setting login page properties
When connecting to the JSCAPE MFT Server Web Gateway the server automatically detects the clients browser language settings and loads the appropriate language file. If a matching language file cannot be found then the default language file is used. The logo and text for the login page may be changed by going to Server > Settings > Web and clicking on the Resources tab.
Figure 47
Chapter 6 Web based file transfers 165
W eb based file transfers 6
Setting HTTP domain level properties
When connecting to the JSCAPE MFT Server Web Gateway the server automatically detects the clients browser language settings and loads the appropriate language file. If a matching language file cannot be found then the default language file is used. The logo and text for the HTTP/S user interface may be changed at the domain level by going to the Services > HTTP/S panel.
Figure 89
Logo - The logo displayed in upper left corner when using HTML user interface.
166 Chapter 6 Web based file transfers
W eb based file transfers 6
Logout URL - The URL to redirect user to upon clicking Logout link.
Connection timeout - The connection timeout for HTTP requests in minutes.
Enable automatic logout - If checked, user will be automatically logged out after X minutes of inactivity with grace period of Y seconds.
Enable web document viewer - If checked web document viewer is enabled.
Enable ad-hoc file transfers - If checked ad-hoc file transfers will be enabled for the domain.
Show buttons shortcuts - If checked, button shortcuts (e.g. F2, F5, F7) are displayed on buttons.
Show login info - If checked, the current username and domain is displayed in upper right.
Show search - If checked searches on indexed documents may be performed.
Show ASCII/Binary option - If checked, user has option of uploading files in both ASCII and binary modes.
If unchecked only binary is allowed by default and user does not have ability to change this setting.
Show account link - If checked the My Account link is displayed in upper right allowing users to change their account contact information.
AFTP NAT Host - The host to use when connecting to AFTP service using Java applet.
Forms... - Forms available during file upload when using HTML user interface.
Resources... - The current language resource file. Language resource files are used for specifying alternative user interface labels based on client browser default language.
Setting WebDAV domain level properties
When connecting to the JSCAPE MFT Server Web Gateway the server automatically detects the clients browser language settings and loads the appropriate language file. If a matching language file cannot be found then the default language file is used. The logo and text for the Java Applet user interface may be changed at the domain level by going to the Services > WebDAV/S panel.
Figure 90
Chapter 6 Web based file transfers 167
W eb based file transfers 6
Logo - The logo displayed in upper left corner when using WebDAV user interface.
Logout URL - The URL to redirect user to upon clicking Logout link.
Language - The current language resource file. Language resource files are used for specifying alternative user interface labels based on client browser default language.
Enable Java applet - If checked, Java applet interface is enabled for WebDAV connections.
Enable web document viewer - If checked web document viewer is enabled.
Show login info - If checked, the current username and domain is displayed in upper right.
Show account link - If checked the My Account link is displayed in upper right allowing users to change their account contact information.
Performing automatic login
If you are integrating JSCAPE MFT Server Web Gateway into an existing web based application you may already have the needed user login credentials. To prevent users from being required to enter login credentials again, you may embed all login credentials as URL parameters. Upon successful login user will be automatically logged into the JSCAPE MFT Server Web Gateway.
be used.
Example http://hostname:port/action/login?
domain=localhost&username=jsmith&password=secret&continue=/action/cwd?
filename=/path/to/dir
168
URL Parameters hostname - The hostname or IP of the web server.
port - The port of the web server.
Chapter 6 Web based file transfers
W eb based file transfers 6 domain - The domain to login to.
username - The username to login as.
password - The password to login with.
continue - The relative URL to redirect user to after login. In the example above the continue argument is used to redirect user to a specified directory upon login.
See also
Specifying logout URL
By default when clicking the Logout link in JSCAPE MFT Server Web Gateway the user will be logged out and presented with the login page for JSCAPE MFT Server Web Gateway. In the event you want the enduser to be redirected to another URL you may specify this in the Logout URL field found in the panels for
Services > HTTP/S and Services > WebDAV/S.
SSO may also be used for defining login and
logout URL.
Note, the Logout URL does not apply to session timeouts. If the HTTP/S session experiences a timeout then user will be redirected to the login page.
See also
Adding custom forms on file upload
When uploading files using the web based HTML user interface you can optionally request additional information from users to be included with the file upload. This information can be included on a per file basis or in batch mode and captured as part of the File Upload event in a trigger.
Creating an upload form
To create an upload form go to the Services > HTTP/S panel in JSCAPE MFT Server Manager and click on the Forms button. The Upload Forms dialog is displayed showing a list of current forms.
Figure 121
169 Chapter 6 Web based file transfers
W eb based file transfers 6
To add a form, click on the Add button. The Add Form dialog is displayed.
Figure 122
170 Chapter 6 Web based file transfers
W eb based file transfers 6
Name - The Name of this form.
Description - A brief description of this form.
Prompt - Sets the prompt method for this form. Batch mode shows the form once for a batch of files to be uploaded. File mode shows the form for each file to be uploaded.
Require group - Requires that user be a member of specified group for form to be available.
Enabled - Sets whether the form is enabled.
Creating upload form fields
Forms may include one or more of the following field types. To add a form field click on the Add button.
Figure 123
Chapter 6 Web based file transfers 171
W eb based file transfers 6
Text - A single line text field.
Memo - A multi-line text field.
Dropdown - A single select drop-down list. Available choices must be specified in Value field in comma delimited format. e.g. value1,value2,value3
Multiselect - A multi-select drop-down list. Available choices must be specified in Value field in comma delimited format. e.g. value1,value2,value3
Radio - A single select radio button option. Available choices must be specified in Value field in comma delimited format. e.g. value1,value2,value3
Capturing upload form data
Upload form data can be captured by listening for the File Upload event in a trigger. There are two event properties in each File Upload event that you can use to detect whether form data was submitted and the form used.
FormDataFound - Whether or not form data was included as part of file upload.
UploadFormName - The name of the upload form used if form data is found.
Form field information can be captured using the event property
UploadForm.UploadFormName.UploadFormFieldName
. For example, if you have a form named
Comments with a field named Feedback then the event property to get this field would be
UploadForm.Comments.Feedback
.
172 Chapter 6 Web based file transfers
W eb based file transfers 6
Enabling web document viewer
JSCAPE Web Document Viewer is available as port of the Enterprise Edition of JSCAPE MFT Server product. JSCAPE Web Document Viewer simplifies content distribution by embedding a document viewer in the JSCAPE MFT Server web interface allowing users to view documents on the server without having to download files locally or have supporting software installed.
* Note, JSCAPE Web Document Viewer may only be used to view files that physically reside on the server.
Files that are located on another server and are accessible via a reverse proxy are not visible when using
JSCAPE Web Document Viewer.
Installation and Configuration
Installation and Configuration
The steps for installation and configuration of JSCAPE Web Document Viewer are as follows:
1. Download and install the latest version of OpenOffice or LibreOffice for your platform.
2. Download and install the latest version of SWFTools for your platform.
3. Go to Server > Settings > Web > Web Document Viewer panel in JSCAPE MFT Server
Manager.
4. Check the Enable document viewer option and set the installation directories of OpenOffice/
LibreOffice and SWFTools. Additionally, set a temporary directory to be used for file conversion purposes.
Figure 124
Chapter 6 Web based file transfers 173
W eb based file transfers 6
Enable document viewer - Enables/disables JSCAPE Web Document Viewer service.
Settings
Office directory - The installation directory of OpenOffice/LibreOffice.
SWF tool directory - The installation directory of SWFTools.
Output directory - Temporary directory to be used for document conversion.
5. Enable web document viewer for HTTP and WebDAV services. Click Apply to save settings.
Figure 125
174 Chapter 6 Web based file transfers
W eb based file transfers 6
Figure 126
Usage
To use JSCAPE Web Document Viewer login to the JSCAPE MFT Server Web Gateway. At this point you should see a View button on the main toolbar. To view a document in the HTML user interface, select the checkbox next to the document filename and click the View button. For the Java Applet (WebDAV) user interface a similar icon is presented in the remote directory toolbar.
Figure 127
Chapter 6 Web based file transfers 175
W eb based file transfers 6
Figure 128
176 Chapter 6 Web based file transfers
W eb based file transfers 6
Supported Document Formats
OpenDocument Text (*.odt)
OpenOffice.org 1.0 Text (*.sxw)
Rich Text Format (*.rtf)
Microsoft Word (*.doc,*.docx)
WordPerfect (*.wpd)
Plain Text (*.txt)
HTML1 (*.html,*.htm)
OpenDocument Spreadsheet (*.ods)
OpenOffice.org 1.0 Spreadsheet (*.sxc)
Microsoft Excel (*.xls,*.xlsx)
Comma-Separated Values (*.csv)
Tab-Separated Values (*.tsv)
OpenDocument Presentation (*.odp)
OpenOffice.org 1.0 Presentation (*.sxi)
Microsoft PowerPoint (*.ppt,*.pptx)
OpenDocument Drawing (*.odg)
Portable Document Format (*.pdf)
Flash (*.swf)
JPG (*.jpg,*.jpeg)
GIF (*.gif)
PNG (*.png)
Drop zones
Drop zones are a way for you to create a space where users can upload files anonymously via their web browser. Users accessing a drop zone are shown an upload form that allows them to upload one or more files. These users cannot see any of the files that they or other users have uploaded to the drop zone.
A drop zone is typically used when you want to receive files from one or more people but don't want to create an account for them, allowing them to upload files anonymously.
Detecting files uploaded to a drop zone
Creating a drop zone
To create a drop zone go to the Drop Zones module in JSCAPE MFT Server Manager.
Figure 135
Chapter 6 Web based file transfers 177
W eb based file transfers 6
Click the Add button. The Add Drop Zone dialog is displayed.
Figure 136
Name - A unique name to assign to the drop zone.
Path - The virtual path for the account that files uploaded to drop zone will be placed in.
178 Chapter 6 Web based file transfers
W eb based file transfers 6
User - The user that this drop zone is mapped to.
Owner - The optional domain administrator who owns this drop zone.
URL branding - The optional URL branding to apply to this drop zone. If set the logo for the URL branding will be used when accessing the drop zone.
Create directory if not found - If virtual path for account is not found then it will be created when drop zone is first accessed.
Overwrite file if exists - If file with same name exists in Path then file will be overwritten, otherwise a unique sequential identifier will be added to filename.
URL - The relative URL that is assigned to the drop zone. This is unique and is automatically generated.
Purging a drop zone
You may purge files from a drop zone as needed. This will effectively delete all files in the drop zone for the mapped account / virtual path. Use this with extreme caution as deleted files may not be recovered.
To purge files from a drop zone go to the Drop Zones module in JSCAPE MFT Server Manager, select the drop zone you would like to purge and click the Purge button. See Figure 135 above.
Detecting files uploaded to a drop zone
Files uploaded to a drop zone will fire a File Upload trigger event, similar to the way that files uploaded using the standard web interface or other file transfer services will also fire a File Upload event. This event can be captured using a trigger and responded to based on your needs. For example, anytime a file is uploaded to the drop zone you may wish to move the file to another location using Move File action, followed by sending out an email notification using the Send Email action.
See also
URL branding
URL branding allows you to specify one or more custom login pages when using the web interface. This is useful in shared environments where you have several customers / users accessing a single domain and you want them each to have their own custom logo displayed.
Creating URL branding
To create a URL branding instance go to the URL Branding module in JSCAPE MFT Server Manager.
Figure 137
179 Chapter 6 Web based file transfers
W eb based file transfers 6
Click the Add button. The Add URL Branding dialog is displayed.
Figure 138
180
Name - A unique alpha-numeric name used to identify this URL branding instance. This name will be used in generating the URL used for accessing the login page.
Logo - The logo to display in login and subsequent pages when accessing and logging in via URL.
Owner - Optional owner field. This may be set to a domain administrator. If the domain administrator has
Chapter 6 Web based file transfers
W eb based file transfers 6 rights to manage URL branding instances then they will be able to manage this URL branding instance from the web interface.
URL - The URL to use to access this URL branded instance.
Searching and tagging documents
Using JSCAPE MFT Server Web Gateway you can search documents based on their indexed file contents, filename, filesize, last modified date, or keyword tags that you associate with documents.
Searching documents
Figure 140
Tagging documents
To tag a document select the checkbox next to the filename in the web interface. Next, click the Manage
Tags button to associate tags with this document and the Manage Tags dialog will be displayed prompting you for a space separated list of keywords or phrases to associate with this document. Phrases consisting of multiple words should be quoted. To remove tags for a document click the Manage Tags button, remove desired keywords or phrases from the Keywords field and click OK to save.
Figure 141
Chapter 6 Web based file transfers 181
W eb based file transfers 6
Overview
JSCAPE MFT Server Enterprise Edition supports ad-hoc email transfers. Ad-hoc email transfers offer a method in which users of JSCAPE MFT Server Web Gateway can email files to any valid email address while avoiding the problems typically associated with emailing files. Unlike a typical email client that attaches files to an email message and sends the email message to the recipient, ad-hoc email transfer send a very small email message to the user with one or more automatically generated web based links embedded in the body of the message. The web based links embedded in the email message provide information on the files sent and allow the recipient to download the files at their own leisure.
Ad-hoc email transfers provide the following benefits:
Avoid bounced emails due to large file attachments or strict firewall rules at the email server.
Avoid clogging recipients inbox with large file attachments allowing user to download files at their convenience.
Email multiple files or entire directories with ease.
Receive optional notification when recipient picks up files.
Streamline document collaboration both internally and with customers.
Restrict access to content after a given period of time.
Email files to users without having to create a user account on the server.
See also
Enabling email transfers
Email transfers may be enabled in the Server > Settings > Email panel. For a user to be able to perform ad-hoc email transfers the Enable email service option must be enabled in both the Server
> Settings > Email panel and the Enable ad-hoc email transfers option must be enabled for the specified user account and in the Server > Settings > Email > Ad-Hoc File
Transfer panel.
Figure 91
182 Chapter 6 Web based file transfers
Email transfers 7
Enable email service - Enables email
Email Server
Host/IP - The hostname or IP of the SMTP server.
Port - The port of the SMTP server.
Connection type - The type of connection to use. PLAIN indicates a plain-text SMTP session. SSL and
START-TLS are encrypted SMTP sessions. Consult your SMTP server documentation for details on what connection types are supported.
Username - Optional username to use if SMTP server requires authentication.
Password - Optional password to use if SMTP server requires authentication.
Debug file - Optional debug file for use in debugging SMTP server problems.
Message
From - Optional From address used when sending emails. This may be overridden by user when performing ad-hoc email transfers.
Miscellaneous
Encrypt with PGP key - Optional encryption key for use in OpenPGP encrypting outbound email messages.
Chapter 7 Email transfers 183
Email transfers
Sign with PGP key - Optional signing key for use in OpenPGP signing outbound email messages.
7
Figure 147
Ad-Hoc Email File Transfer Settings
Enable ad-hoc email transfer - Check to enable email transfers.
Settings
Link expiration range - The minimum and maximum values that will be displayed to user for setting email link expiration.
Max downloads default - If maximum downloads are enabled then this is the default value supplied in web interface.
Enable password protection - Check to password protect email links.
Datastore Settings - Specify how ad hoc email transfer records are stored.
Allowed Recipients
Allow recipients listed as public contacts - Email addresses for public contacts created in Contacts module will be automatically allowed.
Allow recipients in specified TLD - Email addresses which belong to specified TLD (top level domains) will be allowed.
184 Chapter 7 Email transfers
Email transfers 7
See also
Emailing files
To email files via the JSCAPE MFT Server Web Gateway select one or more files and/or directories and click the Email File(s) button. A dialog will be displayed prompting you for additional information.
Figure 92
To - The email address to send the email message to. Multiple addresses may be separated using a comma. Existing contacts may be selected by clicking the Contacts icon next to To field.
Add Cc - Adds Cc (carbon-copy) email addresses.
Add Bcc - Adds Bcc (blind-carbon-copy) email addresses.
From - The From address to send the email message from. This will default to the email address of the user sending the ad-hoc email. If no email address is found then the From address defined in Server >
Settings > Email will be used.
Add Reply-To - Sets Reply-To header for email message, providing a Reply-To address that may be different than the default From email address.
Chapter 7 Email transfers 185
Email transfers 7
Subject - The subject of the message.
Files - The files to send.
Password protect with - If password protection is enabled then user may have the option to specify a password. Options available include: user-defined password sent out-of-band - Sender specifies a password that is communicated to recipient out-of-band (e.g. over the phone or other method) random password sent via email - A random password is generated by the server and included in email message sent to recipient.
Expires - The number of days for which these files may be accessed by the recipient.
Max downloads - The maximum number of times recipient may download files.
Delete after max downloads - Automatically deletes file after maximum number of downloads is reached.
See also
Managing contacts
The Contacts module may be used to manage email contacts for use in ad-hoc email transfers. In sending an ad-hoc email transfer recipients may be selected from the Contacts module rather than typing in the email address each time. Contacts may be defined as private (visible only to the user that created the contact) or public (visible to all users for the domain).
Contacts without an owner are considered private contacts. Contacts may be created/managed from either the Contacts module in JSCAPE MFT Server Manager or via the Contacts module in the web interface under My Account. By default, contacts created in the web interface are private contacts visible only to the user that created them unless user has domain administration rights and the ability to create public contacts.
Figure 144
186 Chapter 7 Email transfers
Email transfers 7
Figure 145
Name - The full name of the contact.
Email - The contact email address.
Company - The company name of contact.
Owner - The owner of contact. If an owner is selected then contact will be marked as private and will only be visible to the owner, otherwise contact will be marked as public and will be visible to all users for the domain.
Chapter 7 Email transfers 187
Monitoring directories 8
Overview
JSCAPE MFT Server includes support for monitoring local directories for files added, files deleted or files changed. Using a directory monitor you can capture these events and respond to them using a trigger.
Generally you should use a directory monitor only when the directory is not managed using a service like
FTP/S, SFTP or HTTP/S. If the directory is managed using a JSCAPE MFT Server service then you can capture these events more effectively using File Upload, File Renamed and File Deleted event types without using a directory monitor.
See also
Creating a directory monitor
To view a list of directory monitors click on the Directory Monitors node for the desired domain.
Figure 81
To add a directory monitor click on the Add button in the lower right corner. The Add Directory
Monitor wizard will be displayed.
Figure 82
188 Chapter 8 Monitoring directories
Monitoring directories 8
Name - Unique name you wish to assign to this directory monitor.
Directory - The directory you wish to monitor.
Monitor interval (sec) - The optional frequency in seconds that you wish to check directory for changes. If not enabled then you may run the directory monitor on a scheduled basis using a Current Time event trigger and Run Directory Monitor action.
Latency period (sec) - If file has been modified within defined latency period then directory monitor event will not be fired. This option may be used to prevent responding to a directory monitor event on a file that is in process of being written.
Owner - Sets the owner for this directory monitor for use in displaying disk quota information via the web interface.
Enable quota (Mb) - The maximum amount of data that may be stored in this directory. If quota is exceeded then file transfers to this directory will be refused and corresponding Directory Monitor Quota
Chapter 8 Monitoring directories 189
190
Monitoring directories 8
Exceeded event will be fired.
Monitor file add - Fire an event whenever a file is added to this directory.
Monitor file edit - Fire an event whenever a file in this directory is changed.
Monitor file delete - Fire an event whenever a file in this directory is deleted.
Monitor recursively - If checked server will monitor all files in this directory and subdirectories when determining quota and looking for new, edited or deleted files.
Once the directory monitor has been created, you can capture any changes made to the directory using triggers and events. The available events for a directory monitor include Directory Monitor File
Added , Directory Monitor File Changed, Directory Monitor File Deleted and
Directory Monitor Quota Exceeded . See the user documentation on triggers for more information on how to capture and respond to these events.
See also
Overview
What is AFTP?
AFTP (Accelerated File Transfer Protocol) is a file transfer protocol developed by JSCAPE. AFTP is designed to accelerate file transfers over high speed networks that are unable to fully utilize network throughput due to high latency and packet loss. Under these conditions AFTP can accelerate file transfers up to 100 times faster than FTP and other file transfer protocols.
How does it work?
Popular file transfer protocols such as FTP/S, SFTP and HTTP/S depend on an underlying protocol named
TCP. The problem with TCP is that as network conditions such as latency and packet loss increase, network throughput is significantly reduced. This is largely to due to the algorithm used to ensure TCP's reliability. TCP uses a sliding window algorithm that reduces throughput as latency and packet loss increase. The result is that file transfer protocols based on TCP are often unable to fully utilize bandwidth available, in effect greatly increasing the amount of time needed to transfer a file. The effects of this are often seen in satellite, transcontinental and transoceanic file transfers.
AFTP solves this problem by changing the way file transfers are performed. Rather than relying exclusively on TCP, AFTP has two communications channels using a combination of TCP and UDP protocols. The first channel, called the control channel, uses TCP and is responsible for tasks such as user authentication, file management and coordinating file transfers. The second channel, called the data channel, uses UDP and is responsible for transferring file data. Unlike TCP, UDP does not suffer the same level of throughput reduction when compared to TCP under similar network conditions. AFTP is able to capitalize on this by transmitting a majority of data over UDP, thus providing optimal throughput. AFTP implementations can achieve reliable file transfers while reducing file transfer times by several orders of magnitude (up to 100x) when compared to TCP based file transfer protocols.
Will AFTP work for me?
AFTP provides the greatest performance gains when used in high bandwidth networks ( > 5Mbps) that suffer from high latency ( > 50ms). For example, a file transfer between Tokyo and Los Angeles over a
45Mbps connection is likely to have high latency given the geographical distance between these two
Chapter 8 Monitoring directories
Accelerated file transfer (AFTP) 9 locations and will benefit from the use of AFTP. Conversely, a file transfer between two hosts on a LAN
(Local Area Network) over a 100Mbps connection is unlikely to have high latency or benefit from the use of
AFTP.
What is latency?
In a network, latency is a measure of the amount of time it takes for a packet of data to get from one network point to another. Latency can be affected by many variables including distance between points, the number of gateways between points, and the medium used (e.g. wireless, fiber optics). Latency is typically measured in milliseconds (ms). Example: The latency between Host A in Los Angeles and Host
B in Tokyo is 200 ms.
What is packet loss?
Packet loss is a network condition when one or more packets of data fail to reach their intended destination. Packet loss is measured as a percentage of packets that do not reach their destination, also known as lost or dropped packets. Example: The packet loss between Host A in Los Angeles and Host B in Tokyo is 1.0%.
What is throughput?
Throughput is the actual rate of data delivery over a network. Throughput is typically measured in bps (bits per second). Throughput is often a fraction of bandwidth due to network conditions such as latency and packet loss. Example: The throughput between Host A in Los Angeles and Host B in Tokyo is 5Mbps.
What is bandwidth?
Bandwidth is the theoretical maximum rate of data delivery over a network. Bandwidth is typically measured in bps (bits per second). Example: The bandwidth between Host A in Los Angeles and Host B in Tokyo is 45Mbps.
What is TCP?
TCP (Transmission Control Protocol) is a reliable IP based network protocol in that all packets are sent in order and if a packet is lost it will automatically attempt to resend that packet. See also TCP on
Wikipedia .
What is UDP?
UDP is a sibling to the TCP protocol, both of which are dependent on the underlying IP stack. Unlike TCP,
UDP does not require that packets be sent in order and does not automatically attempt to retransmit lost packets. Retransmission and reordering of packets are the responsibility of the higher level protocol, in this instance AFTP. See also UDP on Wikipedia .
Adding AFTP service
The AFTP service may be added using the Services node in JSCAPE MFT Server Manager. The AFTP service is available only in the Enterprise edition of JSCAPE MFT Server.
See also
Chapter 9 Accelerated file transfer (AFTP) 191
Accelerated file transfer (AFTP)
Connecting to AFTP service
In order to connect to the AFTP service you must use an AFTP client. JSCAPE currently offers the following AFTP clients.
9
AnyClient
AnyClient Enterprise
AnyClient Web
AFTP Java Client Library (contact JSCAPE for access)
File Transfer Command Line
Trigger actions
There are also a number of AFTP trigger actions in JSCAPE MFT Server that may be used for automating
AFTP file transfer processes.
Overview
Data Loss Prevention (DLP) are systems that identify and prevent the loss of sensitive data. The DLP module in JSCAPE MFT Server Enterprise Edition can be used to identify sensitive data at rest and prevent it's unauthorized distribution over all file transfer protocols supported by JSCAPE MFT Server.
Creating DLP Rules
DLP rules are regular expressions that are used in identifying sensitive data at rest. JSCAPE MFT Server has a number of built-in rules that may be used to identify sensitive data at rest such as credit card numbers (Visa, MasterCard, Amex, Discover) , U.S. social security numbers, UK national insurance numbers and IBAN account numbers.
To create a DLP rule go to the DLP module in JSCAPE MFT Server Manager. Here you will find a list of currently available DLP rules.
Figure 148
192 Chapter 9 Accelerated file transfer (AFTP)
Data loss prevention (DLP) 10
To create a new rule click on the Add button. The Add DLP Rule dialog will be displayed.
Figure 149
Name - Unique name for the DLP rule.
Description - Description of DLP rule.
Chapter 10 Data loss prevention (DLP) 193
Data loss prevention (DLP)
Scope - Scope of rule when applying regular expression. A scope of File contents will analyze contents of file for instances of regular expression. A scope of Filename will analyze filename for instances of regular expression.
10
Regular expression - The regular expression to use when performing content analysis.
See also
Regular expression reference
Enabling DLP
DLP may be enabled for any virtual path. This gives you the power and flexibility to limit DLP at the directory, user or group level depending on your needs.
To enable DLP for a virtual path, select the virtual path and click Edit. Next, click the Enable DLP option followed by the Settings button to define which DLP rules and actions should be applied to the virtual path.
Figure 150
194 Chapter 10 Data loss prevention (DLP)
Data loss prevention (DLP)
Figure 151
10
Rules are processed in order. The first rule to match determines access level. Use the "Up" and "Down" buttons to change the order in which rules are processed.
Figure 152
DLP rule - The DLP rule to add.
Chapter 10 Data loss prevention (DLP) 195
Data loss prevention (DLP) 10
Access - The level of access to grant when DLP rule regular expression is matched. The allow all option allows access and raises a DLP Rule Matched trigger event. The deny all option denies access and raises a DLP Rule Matched trigger event. The deny ad-hoc option denies access to email recipients via ad-hoc file transfer and raises a DLP Rule Matched event.
Enabled - Enables/disabled DLP rule.
Capturing DLP events
As part of any DLP implementation you may want to be notified anytime a DLP rule has been triggered.
This can be accomplished using a trigger and the DLP Rule Matched event.
See also
Overview
The JSCAPE MFT Server Java Management API is a Java based API for programmatically managing your
JSCAPE MFT Server. Using the JSCAPE MFT Server Java Management API you may perform functions like creating domains, adding user accounts, creating groups, stopping and starting domains and various other management functions.
The JavaDoc for the JSCAPE MFT Server Java Management API may be found in the doc/api directory of your JSCAPE MFT Server installation.
See also
Requirements
The JSCAPE MFT Server Java Management API requires that Oracle or IBM JDK 1.6 or above be used. All classes for the JSCAPE MFT Server Java Management API are part of the ftpserver.jar library which is located in your JSCAPE MFT Server libs directory.
Linux/Solaris/UNIX
The examples provided in the doc/api-examples directory are written to connect to the server using the credentials and server settings stored in the client.cfg configuration file. To run any of the examples you must first configure the client.cfg settings by running the following command.
./manager-configuration -host [ip address] -port [port] -rest.host [ip address] -rest.port [rest.port] -user [username] -password [password]
Example
./server-configuration -host 127.0.0.1 -port 10880 -rest.host 127.0.0.1 rest.port 11880 -user admin -password secret
Where [ip address] and [port] are the IP/port that the JSCAPE MFT Server Service is listening on,
[rest.port] is the port that the REST web service is listening on, and [username] [password] are
196 Chapter 10 Data loss prevention (DLP)
Java Management API the credentials you will use when connecting to the service. Defaults ports for JSCAPE MFT Server
Service and REST web service are 10880 and 11880 respectively.
11
Creating a domain
Please see the source code example available in the doc/api-examples/create_domain directory of your JSCAPE MFT Server installation.
Creating an account
Please see the source code example available in the doc/api-examples/create_account directory of your JSCAPE MFT Server installation.
Creating a group
Please see the source code example available in the doc/api-examples/create_group directory of your JSCAPE MFT Server installation.
Creating a reverse proxy
Please see the source code example available in the doc/api-examples/create_resource directory of your JSCAPE MFT Server installation.
Stopping and starting a domain
Please see the source code example available in the doc/api-examples/start_stop_domain directory of your JSCAPE MFT Server installation.
Client REST API
The client REST API may be used to perform file transfers over HTTP and HTTPS services in JSCAPE MFT
Server. To enable client REST services you must enable the HTTP or HTTPS services for JSCAPE MFT
Server.
Documentation and Examples
For API documentation on client REST services available visit http://localhost/doc/api where localhost is the hostname listening for HTTP requests. Additional REST API examples may be found in the doc/api-
examples/rest directory relative to your JSCAPE MFT Server installation directory.
See also
Enabling web based file transfers
Management REST API
The management REST API may be used to manage JSCAPE MFT Server over HTTP/S services in
JSCAPE MFT Server. To enable management REST services you must enable the REST HTTP and/or
REST HTTPS services for JSCAPE MFT Server. To achieve this go to Server > Settings > Web >
REST from the main menu.
Documentation and Examples
For API documentation on client REST services available visit http://localhost:11880/ where localhost is the hostname and 11880 is the port listening for REST HTTP requests. Next, login using administrative credentials and click the Help > REST API link to access the online documentation.
Additional REST API examples may be found in the doc/api-examples/rest directory relative to your
JSCAPE MFT Server installation directory.
Chapter 11 Java Management API 197
REST API 12
See also
Enabling web based file transfers
198
Overview
Several command line utilities are included as part of JSCAPE MFT Server. Ideal for scripting purposes or for use in a non-GUI environment, these command line utilities allow you to quickly perform common functions without having to use JSCAPE MFT Server Manager.
See also
js-adddirmonitor js-adddomain js-addgroup
js-addserviceftp js-addservicehttp js-addservicesftp
js-addservicewebdav js-adduser js-adduserdir
js-copyusers js-deldomain js-delgroup
js-deluser js-enablehttp js-enablehttps
js-importcontacts js-importusers
js-passwd js-pausedomain js-resumedomain
js-runtrigger js-sendmessage js-setdomainquota
js-setuserquota js-shutdown js-shutdowndomain
js-startdomain js-stopdomain js-triggersreport
Note
Command line argument parameters which contain spaces must be surrounded in quotes to be processed correctly.
e.g.
Chapter 12 REST API
Command line utilities 13
-type "explicit SSL"
See also
js-adddirmonitor
The js-adddirmonitor command may be used to add a directory monitor to JSCAPE MFT Server.
Usage: js-adddirmonitor -n <value> -r <value> [-options]
Options:
-d the domain name
-n directory monitor name
-r directory path (e.g. c:\home)
-t monitor interval (seconds)
-q directory quota (MB)
-l latency period
-o directory monitor owner
-a enable monitor file add
-e enable monitor file edit
-de enable monitor file delete
-re enable monitor recursively
-h display this help menu
If js-adddirmonitor command is run without options then user will be prompted for necessary information.
js-adddomain
The js-adddomain command may be used to add a domain to JSCAPE MFT Server.
Usage: js-adddomain [-options]
Options:
-d the domain name
-ld log directory
-ds user datastore directory
-h display this help menu
If js-adddomain command is run without options then user will be prompted for necessary information.
js-addgroup
The js-addgroup command may be used to add a group to JSCAPE MFT Server.
Usage: js-addgroup [-options]
Options:
-d the domain name
-g the groupname
-p the virtual path
Chapter 13 Command line utilities 199
Command line utilities
-r the real directory path
-a the path access permissions [RWADRLCDLB]
-f force exit success if group already exists
-h display this help menu
13
If js-addgroup command is run without options then user will be prompted for necessary information.
See also
js-addgroupdir
The js-addgroupdir command may be used to add a directory path to an existing group in JSCAPE
MFT Server.
Usage: js-addgroupdir [-options]
Options:
-d the domain name
-g the groupname
-p the path
-r the real directory path
-a the path access permissions [RWADRLCDLB]
-h display this help menu
If js-addgroupdir command is run without options then user will be prompted for necessary information.
See also
js-addserviceaftp
The js-addserviceaftp command may be used to add an AFTP service to JSCAPE MFT Server.
Usage: js-addserviceaftp [-options]
Options:
-d <name> the domain name
-host <value> host address
-p <value> port
-k <alias> server key
-s <true|false> secure connection required
-h display this help menu
If js-addserviceaftp command is run without options then user will be prompted for necessary information.
200 Chapter 13 Command line utilities
Command line utilities
js-addserviceftp
The js-addserviceftp command may be used to add a FTP service to JSCAPE MFT Server.
13
Usage: js-addserviceftp [-options]
Options:
-d <name> the domain name
-host <value> host address
-p <value> port
-t <value> ftp type (regular, explicit SSL, forced explicit SSL, implicit
SSL)
-k <alias> server key
-h display this help menu
If js-addserviceftp command is run without options then user will be prompted for necessary information.
js-addservicehttp
The js-addservicehttp command may be used to add a HTTP and HTTP/S services to JSCAPE MFT
Server.
Usage: js-addservicehttp [-options]
Options:
-d the domain name
-http enable http (true|false)
-https enable https (true|false)
-h display this help menu
If js-addservicehttp command is run without options then user will be prompted for necessary information.
js-addservicesftp
The js-addservicesftp command may be used to add SFTP service to JSCAPE MFT Server.
Usage: js-addservicesftp [-options]
Options:
-d <name> the domain name
-host <value> host address
-p <value> port
-a <value> authentication type (password, publickey, password OR publickey, pass word AND publickey)
-k <alias> server key
-h display this help menu
If js-addservicesftp command is run without options then user will be prompted for necessary information.
201 Chapter 13 Command line utilities
Command line utilities 13
js-addservicewebdav
The js-addservicewebdav command may be used to add WebDAV service to JSCAPE MFT Server.
Usage: js-addservicewebdav [-options]
Options:
-d the domain name
-http enable http (true|false)
-https enable https (true|false)
-h display this help menu
If js-addservicewebdav command is run without options then user will be prompted for necessary information.
js-adduser
The js-adduser command may be used to add a user to JSCAPE MFT Server.
Usage: js-adduser [-options]
Options:
-d <name> the domain name
-t <name> the template name
-n <name> the user full name
-u <name> the username (login)
-p <password> the account password
-r <path> the user home directory
-a <permissions> the user home directory access permissions [RWADRLCDLB]
-e <email> the email address
-g <name> the group
-c <name> company name
-f force exit success if user already exists
-h display this help
If js-adduser command is run without options then user will be prompted for necessary information.
See also
js-adduserdir
The js-adduserdir command may be used to add a directory path to an existing user in JSCAPE MFT
Server.
Usage: js-adduserdir [-options]
Options:
-d the domain name
-u the username
-p the path
-r the real directory path
-a the path access permissions [RWADRLCDLB]
202 Chapter 13 Command line utilities
Command line utilities 13
-h display this help menu
If js-adduserdir command is run without options then user will be prompted for necessary information.
See also
js-as2util
The js-as2util command may be used to get information about AS2 messages in JSCAPE MFT
Server.
Usage: js2-as2util [-options]
-id <message id> target message id
[-f <file>] write message to specified filename
[-k <key alias>] decryption key alias
-d decrypt the specified message
-s display certificate alias and serial used in signing message
-h display this help menu
If js-as2util command is run without options then user will be prompted for necessary information.
js-copyusers
The js-copyusers command may be used to copy users for one domain to another domain in JSCAPE
MFT Server. This utility is typically used for user migration purposes.
Usage: [-d <destination domain>] [-s <source domain>] [-h]
Options:
-s the source domain name
-d the destination domain name
-h display this help menu
If js-copyusers command is run without options then user will be prompted for necessary information.
js-deldomain
The js-deldomain command may be used to delete a domain in JSCAPE MFT Server.
Usage: js-deldomain [-options]
Options:
-d the domain name
-h display this help menu
If js-deldomain command is run without options then user will be prompted for necessary information.
js-delgroup
The js-delgroup command may be used to delete an existing group from JSCAPE MFT Server.
Usage: js-delgroup [-options]
Chapter 13 Command line utilities 203
Command line utilities 13
Options:
-d the domain name
-g the groupname
-h display this help menu
If js-delgroup command is run without options then user will be prompted for necessary information.
js-deluser
The js-deluser command may be used to delete an existing user from JSCAPE MFT Server.
Usage: js-deluser [-options]
Options:
-d the domain name
-u the username
-f force exit success if user does not exist
-h display this help menu
If js-deluser command is run without options then user will be prompted for necessary information.
js-enablehttp
The js-enablehttp command may be used to enable HTTP service in JSCAPE MFT Server.
Usage: js-enablehttp [-options]
Options:
-host http host
-p http port
-h display this help menu
If js-enablehttp command is run without options then user will be prompted for necessary information.
js-enablehttps
The js-enablehttps command may be used to enable HTTPS service in JSCAPE MFT Server.
Usage: js-enablehttps [-options]
Options:
-host <value> host address
-p <value> port
-k <alias> server key
-h display this help menu
If js-enablehttps command is run without options then user will be prompted for necessary information.
204 Chapter 13 Command line utilities
Command line utilities 13
js-importcontacts
The js-importcontacts command may be used to perform bulk import of contacts stored in CSV file format.
Usage: js-importcontacts [-options]
Options:
-d the domain name
-f file to import
-h display this help menu
-s skip bad lines
If js-importcontacts command is run without options then user will be prompted for necessary information.
Example
John Smith,jsmith@domain,ABC Corp,admin
Henry Jones,hjones@domain,XYZ Corp
js-importusers
The js-importusers command may be used to perform bulk import of users stored in CSV file format.
Usage: js-importusers [-options]
Options:
-d <name> the domain name
-f <path> file to import
-t <name> an account template
-s skip bad lines
-h display this help menu
If js-importusers command is run without options then user will be prompted for necessary information.
File Format
Chapter 13 Command line utilities 205
Command line utilities 13
Import file should be plain text with comma separated values and each user on a new line. Non-required fields may be omitted.
Column #
1
2
3
4
5
6
Column Description
The full name of user.
Required
Yes
The unique user login.
The user password.
Yes
Yes
The user root login path.
Yes / No (not required if template is used)
The user email address.
No
The user group name.
No
Example
John Smith jsmith secret
C:\users\jsmith [email protected]
Administrators
Example
John Smith,jsmith,secret,C:\users\jsmith,[email protected],Administrators
Henry Jones,hjones,secret,C:\users\hjones,[email protected]
js-ipaccess
The js-ipaccess command may be used to perform manage the IP access list for a domain.
Usage: js-ipaccess [-b|-u] [-d <domain>] [-l] [-i <IP address>] [-h]
Options:
-d the domain name
-i insert rule for specified IP address
-b block specified IP address
-u unblock specified IP address
-l lists current IP access settings
-h display this help menu
If js-ipaccess command is run without options then user will be prompted for necessary information.
js-kickuser
The js-kickuser command may be used to forcibly close all sessions for a specified user in JSCAPE
MFT Server.
Usage: js-kickuser [-options]
Options:
-d the domain name
-u the user name
-h display this help menu
If js-kickuser command is run without options then user will be prompted for necessary information.
206 Chapter 13 Command line utilities
Command line utilities 13
js-migrateadhoc
The js-migrateadhoc command may be used migrate ad-hoc entries previously stored in per-domain datastore (H2 database) to a common datastore (user defined relational database) in JSCAPE MFT Server.
Prior to running js-migrateadhoc you must update the datastore used in Server > Settings >
Email > Ad Hoc File Transfer to Use common database option, pointing to a relational database of your choice. Additionally you must create the necessary tables in your database to store ad hoc file transfer records. Example database schema for Oracle, MySQL and MSSQL can be found in the etc/oracle.sql
, etc/mysql.sql and etc/mssql.sql files relative to your JSCAPE MFT Server installation directory.
Usage: js-migrateadhoc [-options]
Options:
-d delete the original data
-h display this help menu
If js-migrateadhoc command is run without options then user will be prompted for necessary information.
js-migrateas2
The js-migrateas2 command may be used migrate AS2 messages previously stored in per-domain datastore (H2 database) to a common datastore (user defined relational database) in JSCAPE MFT Server.
Prior to running js-migrateas2 you must update the datastore used in Server > Settings > Web
> AS2 to Use common database option, pointing to a relational database of your choice. Additionally you must create the necessary tables in your database to store AS2 messages. Example database schema for Oracle, MySQL and MSSQL can be found in the etc/oracle.sql, etc/mysql.sql and etc/mssql.sql
files relative to your JSCAPE MFT Server installation directory.
Usage: js-migrateas2 [-options]
Options:
-d delete the original data
-h display this help menu
If js-migrateas2 command is run without options then user will be prompted for necessary information.
js-migrateoftp
The js-migrateoftp command may be used migrate OFTP messages previously stored in per-domain datastore (H2 database) to a common datastore (user defined relational database) in JSCAPE MFT Server.
Prior to running js-migrateoftp you must update the datastore used in Services > OFTP >
Datastore Settings to Use common database option, pointing to a relational database of your choice. Additionally you must create the necessary tables in your database to store OFTP messages.
Example database schema for Oracle, MySQL and MSSQL can be found in the etc/oracle.sql, etc/ mysql.sql
and etc/mssql.sql files relative to your JSCAPE MFT Server installation directory.
Usage: js-migrateoftp [-options]
207 Chapter 13 Command line utilities
Command line utilities
Options:
-d delete the original data
-h display this help menu
If js-migrateoftp command is run without options then user will be prompted for necessary information.
js-passwd
The js-passwd command may be used to update a password for an account.
Usage: [-d <domain>] [-p <password>] [-u <user>] [-h]
13
Options:
-d the domain name
-u the account login
-p the account password
-h display this help menu
If js-passwd command is run without options then user will be prompted for necessary information.
js-pausedomain
The js-pausedomain command may be used to pause a domain in JSCAPE MFT Server. When pausing a domain existing connections will be allowed to continue however new connections will not be accepted.
Usage: js-pausedomain [-options]
Options:
-d the domain name
-h display this help menu
If js-pausedomain command is run without options then user will be prompted for necessary information.
js-resumedomain
The js-resumedomain command may be used to resume a paused domain in JSCAPE MFT Server.
Usage: js-resumedomain [-options]
Options:
-d the domain name
-h display this help menu
If js-resumedomain command is run without options then user will be prompted for necessary information.
208 Chapter 13 Command line utilities
Command line utilities 13
js-runtrigger
The js-runtrigger command may be used to run a trigger which listens for the Current Time event in
JSCAPE MFT Server. When running a trigger using js-runtrigger any conditions for the trigger will be ignored.
Usage: js-runtrigger [-options]
Options:
-d the domain name
-n the trigger name
-h display this help menu
If js-runtrigger command is run without options then user will be prompted for necessary information.
js-sendmessage
The js-sendmessage command may be used to send an email message to all users for a domain.
Usage: js-sendmessage [-options]
Options:
-d domain
-host smtp host
-p smtp port
-t smtp connection type (plain|ssl|start-tls)
-debug enable debug mode (true|false)
-u smtp username
-pass smtp password
-f from address
-s subject
-b body
-h display this help menu
If js-sendmessage command is run without options then user will be prompted for necessary information.
js-setdomainquota
The js-setdomainquota command may be used to set bandwidth quotas at the domain level in
JSCAPE MFT Server.
Usage: js-setdomainquota [-options]
Options:
-d the domain name
-uq max uploads quota
-ur uploads quota reset period (days)
-dq max downloads quota
-dr downloads quota reset period (days)
-tq max transfers quota
-tr transfers quota reset period (days)
-h display this help menu
209 Chapter 13 Command line utilities
Command line utilities
If js-setdomainquota command is run without options then user will be prompted for necessary information.
js-setuserquota
13
The js-setuserquota method may be used to set bandwidth quotas at user level in JSCAPE MFT
Server.
Usage: js-setuserquota [-options]
Options:
-d the domain name
-u the username
-uq max uploads quota (MB)
-ur uploads quota reset frequency (days)
-dq max downloads quota (MB)
-dr downloads quota reset frequency (days)
-tq max transfers quota (MB)
-tr transfers quota reset frequency (days)
-h display this help menu
If js-setuserquota command is run without options then user will be prompted for necessary information.
js-shutdown
The js-shutdown command may be used to perform an orderly shutdown of all services for all domains in JSCAPE MFT Server. In an orderly shutdown all existing processes are allowed to complete while no new connections are accepted.
Usage: js-shutdown [-options]
Options:
-h display this help menu
If js-shutdown command is run without options then user will be prompted for necessary information.
js-shutdowndomain
The js-shutdowndomain command may be used to perform an orderly shutdown of all services for the specified domain in JSCAPE MFT Server. In an orderly shutdown all existing processes are allowed to complete while no new connections are accepted.
Usage: js-shutdowndomain [-options]
Options:
-d the domain name
-h display this help menu
If js-shutdowndomain command is run without options then user will be prompted for necessary information.
210 Chapter 13 Command line utilities
Command line utilities
js-startdomain
The js-startdomain command may be used to start a domain in JSCAPE MFT Server.
Usage: js-startdomain [-options]
Options:
-d the domain name
-h display this help menu
If js-startdomain command is run without options then user will be prompted for necessary information.
js-stopdomain
The js-stopdomain command may be used to stop a domain in JSCAPE MFT Server.
Usage: js-stopdomain [-options]
13
Options:
-d the domain name
-h display this help menu
If js-stopdomain command is run without options then user will be prompted for necessary information.
js-syncstate
The js-syncstate command may be used to synchronize server configuration information from this server to a target server in JSCAPE MFT Server.
Usage: js-syncstate [-options]
Options:
-ip <host/IP> failover server host/IP
-p <port> failover server port
-u <username> administrator username
-pwd <password> administrator password
-s <IP substitution rules> comma delimited list of semi-colon delimited ip substitution rules (e.g. 1.2.3.4,1.2.3.5;4.5.6.7,7.8.9.0)
-h display this help menu
If js-syncstate command is run without options then user will be prompted for necessary information.
js-triggersreport
The js-triggersreport command may be used to list all triggers and settings for a domain.
Usage: js-triggersreport [-options]
Options:
-d <name> the domain name
-h display this help menu
If js-triggersreport command is run without options then user will be prompted for necessary
211 Chapter 13 Command line utilities
212
Command line utilities information.
js-users
The js-users command may be used to list, enable or disable users in JSCAPE MFT Server.
13
Usage: [-d <domain>] [-l] [-fe|-fd] [-u <user>] [-h]
Options:
-d domain name
-l list users
-u user name
-fe enable flag
-fd disable flag
-h display this help menu
If js-users command is run without options then user will be prompted for necessary information.
Enabling WebDAV service
JSCAPE MFT Server Enterprise Edition offers support for the WebDAV file transfer protocol. To enable
WebDAV please perform the following using JSCAPE MFT Server Manager:
1. Go to Server > Settings > Web and enable the HTTP/S protocols.
2. In the Services node for the desired domain, click on the Add button. The Add Service dialog is displayed.
3. Under Protocol select the WebDAV/S option. Select the protocols you wish to enable WebDAV on.
4. Click OK.
See also
Establishing a connection
JSCAPE MFT Server Enterprise Edition has a built-in web based WebDAV Java applet that is integrated into the web server. This applet allows users to connect via WebDAV without having to install any client software.
Connect using integrated WebDAV Java applet
To connect via WebDAV using the integrated Java applet perform the following steps:
1. Load the JSCAPE MFT Server Web Gateway into your web browser.
2. Enter login credentials.
3. When prompted for User Interface select the Java Applet option and click Login.
At this point the browser will load the integrated Java applet and automatically connect using the WebDAV protocol.
Note: You may optionally click the Java Applet button from HTML user interface to switch to the Java applet.
Chapter 13 Command line utilities
W ebDAV support 14
Connect using 3rd party WebDAV client
To connect using a 3rd party WebDAV client you will be prompted for the following information:
URL - The URL (Uniform Resource Locator) that you want to connect to. This generally takes the form of http://hostname:port/webdav/ or https://hostname:port/webdav/ for SSL encrypted connections.
Username - The username to connect with. This should be in the format of username@domain where username is the user you are logging in as and domain is the JSCAPE MFT Server domain you wish to login to.
Password - The password to connect with.
See also
Overview
In the context of JSCAPE MFT Server, a Reverse Proxy consists of all the necessary properties for connecting to a remote FTP/FTPS/SFTP server. The power of reverse proxy lies in it's ability to be mapped to a virtual path for a user or group. This is useful in cases where you want to transparently provide users access to one or more remote FTP/FTPS/SFTP services via a single account.
See also
Mapping a reverse proxy to a virtual path
Creating a reverse proxy
You may create a reverse proxy using the JSCAPE MFT Server Manager. To view a list of reverse proxies click on the Reverse Proxies node for the desired domain.
Figure 48
213 Chapter 14 WebDAV support
Reverse proxy management 15
Add reverse proxy
To add a reverse proxy click on the Add button in the lower right corner. The Add Reverse Proxy dialog will be displayed.
Figure 49
214 Chapter 15 Reverse proxy management
Reverse proxy management 15
Name - Unique name for this reverse proxy.
Host/IP - The remote IP or host address for this reverse proxy.
Connection type - The connection type for this reverse proxy.
Port - The remote port for this reverse proxy.
Timeout - The maximum timeout for establishing a connection to remote server.
Key file - The optional client private key to use for this connection. (FTPS/SFTP)
Key file password - The optional client private key password to use for this connection. (FTPS/SFTP)
Username - The username for connecting to this remote server.
Password - The password for connecting to this remote server.
Use user credentials - Uses the current user credentials instead of a static username and password.
Use passive transfer mode - Flag indicating whether passive mode is used for connecting to this remote
Chapter 15 Reverse proxy management 215
Reverse proxy management 15 server.
Map current local directory to remote directory - If enabled, maps local virtual path to remote virtual path.
For example, if reverse proxy is mapped to virtual path /path then when connecting to reverse proxy it will drop user in /path directory on target server.
Debug log directory - Directory in which to store debug logs for this reverse proxy.
Max proxy age - The maximum amount of time to keep this reverse proxy connection in connection pool.
Mapping a reverse proxy to a virtual path
Mapping a reverse proxy to a virtual path is a powerful feature that allows users to transparently access one or more remote FTP/SFTP servers via a single client session. In order to map a reverse proxy to a virtual path first create a reverse proxy, then map that reverse proxy to a virtual path for a user or group of users. When users access the virtual path of a reverse proxy they will be connected to the remote server.
This is completely transparent to the end user.
See also
Overview
A session is defined as a connection with the server. Current sessions may be seen from the
Statistics module in JSCAPE MFT Server Manager.
Figure 146
216
Close Session - Forcibly terminates selected session.
Overview
JSCAPE MFT Server includes support for FTPS (FTP over SSL), SFTP/SCP and HTTPS connections as well as OpenPGP encryption. In order to take advantage of encryption services you must create one or more keys that may be used for encrypting your sessions and/or files. Key management is accomplished via the Key Manager. To access the Key Manager select Server > Key Manager... from the main
Chapter 15 Reverse proxy management
Key management menu. The Key Manager dialog will be displayed.
Figure 22
17
Server keys
Overview
Server keys are required for encrypting communications between a client and the server when using secure file transfer protocols such as FTPS (FTP over SSL), SFTP (FTP over SSH) and HTTPS. In the context of the Key Manager, a server key consists of a private key, certificate and public key.
Note
Some server keys are installed by default with JSCAPE MFT Server. These are meant only for testing purposes and should not be deployed to a production environment.
Generating a key
To generate a private key open the Key Manager by selecting the Server > Key Manager... option from the main menu. The Key Manager dialog will be displayed.
Figure 22
Chapter 17 Key management 217
Key management 17
Select the Server Keys tab and click on the Generate button. The Generate Server Key dialog is displayed.
Figure 23
218
Key alias - Alias you wish to assign to the key.
Key algorithm - The algorithm used in generating this key. Valid options are RSA and DSA.
Chapter 17 Key management
Key management 17
Key length - The length of the key in bytes. Valid options are 1024 and 2048. Note, for key lengths greater than 1024 you must install the
Unlimited Jurisdiction Policy Files .
Validity - The number of days this key is valid.
Common name - The name you wish to assign this key. Typically the domain name this key will server e.g. ftp.mydomain.com
Organizational unit - The unit within your organization that this key will be used for e.g. IT.
Organization - Your organization name.
Locality - Your city.
State/Province - Your state or province.
Country - Your 2 character country code e.g. "US".
Obtaining a trusted certificate
If you decide to use the web interface for performing file transfers you have the option of securing these transfers using HTTPS. The HTTPS protocol requires an SSL certificate to be used. You can either generate your own self-signed certificate using the Key Manager found in JSCAPE MFT Server Manager, or you can create a certificate signing request (CSR) and have your certificate signed by a third party known as a certificate authority (CA).
Note
When using your own self-signed certificate the client web browser may display a warning message letting the user know that the certificate in use is not signed by a known CA. This is not an error but rather a warning to the user that the certificate has not been validated by a trusted authority. If you wish to avoid this message you should create a certificate signing request and have that certificate signed by a trusted certificate authority.
Generating a private key
The first step in obtaining a CA signed certificate is to generate your own server key. The most important thing to understand when generating your server key is that the Common Name field should match the domain name that clients will use when connecting to your FTPS or HTTPS server. For example, if your
HTTPS or FTPS server will be served under the domain www.mydomain.com then this is the value you
should use in your Common Name field when generating your private key.
See also
Generating a CSR
The next step is to create a certificate signing request for your server key. The CSR will be used by the
CA in order to create a signed certificate. To generate a CSR, highlight the desired server key in the Key
Manager and click the Generate CSR button. A dialog will prompt you for the location in which to store the CSR.
219 Chapter 17 Key management
Key management
Figure 87
17
Submitting CSR to CA
The next step is to submit your CSR to the CA for use in generating your signed certificate. Please consult your CA for instructions on how to accomplish this. Your CA may ask you in which format you would like the certificate. If this option is presented to you select the Other, Apache or Java option to receive the certificate in a common format. To request a JSCAPE signed certificate please visit the following: https://www.securepaynet.net/gdshop/ssl/ssl.asp?prog_id=423530&ci=1789&
Importing signed certificate
The last step is to import the signed certificate issued to you by your CA. To import the signed certificate select the server key that was used to generate the CSR and click the Import Certificates button.
You will be prompted for the path of the certificate file issued to you by your CA.
Note
Some CA issue an intermediate certificate in addition to a signed certificate. If your certificate came with an intermediate certificate you will need to append the contents of the intermediate to the signed certificate issued to you by your CA. If your certificate did not come with an intermediate certificate you may skip these steps.
1. Open your signed certificate and intermediate certificate files using a text editor e.g. notepad or vi.
2. Copy the full contents of the intermediate certificate and append to the end of signed certificate file.
3. Save signed certificate and continue with process of importing signed certificate.
Figure 78
220 Chapter 17 Key management
Key management 17
Certificates file - The file containing signed certificate.
File password - The password protecting certificate. Leave blank if none.
Alias in file - The certificate alias in file. Leave blank if none.
Verifying signed certificate
Upon successfully installing your signed certificate you can verify that it is working by connecting using any HTTPS or FTPS client and viewing the certificate details. You should notice in the certificate details that the CA is listed as a trusted authority for the certificate.
Importing third party certificates
If you have your JSCAPE MFT Server server private key signed by a certificate authority (CA) such as
Thawte, Verisign or JSCAPE you may import the issued certificate using the Import Certificates button.
Note
Some CA issue an intermediate certificate in addition to a signed certificate. If your certificate came with an intermediate certificate you will need to append the contents of the intermediate to the signed certificate issued to you by your CA. If your certificate did not come with an intermediate certificate you may skip these steps.
1. Open your signed certificate and intermediate certificate files using a text editor e.g. notepad or vi.
2. Copy the full contents of the intermediate certificate and append to the end of signed certificate file.
3. Save signed certificate and continue with process of importing signed certificate.
Importing a third party certificate
1. Open Key Manager.
2. Click on Server Keys panel.
3. Select existing key that you wish to import certificates for.
4. Click Import Certificates button.
Chapter 17 Key management 221
Key management
Figure 78
17
Certificates file - The file containing signed certificate.
File password - The password protecting certificate. Leave blank if none.
Alias in file - The certificate alias in file. Leave blank if none.
Importing a key
You may import existing server keys and certificates for use in encrypting FTPS, SFTP and HTTPS connections. To import an existing key/certificate pair open the Key manager by selecting the Server >
Key Manager...
option from the main menu. The Key Manager will be displayed. Select the Server
Keys tab and click on the Import button. The Import Server Key dialog is displayed.
Figure 50
222
Key alias - The local key alias which will be used for storing key in the servers local keystore. This may be any value of your choice.
Chapter 17 Key management
Key management
Key file - The private key file to import from.
File password - The password protecting the keystore. Leave blank if none.
Key alias in file - The private key alias in keystore. Leave blank if none.
Key password - The password protecting the private key. Leave blank if none.
Note
If you are unsure of the alias for the source keystore this may be obtained as follows:
JKS k eystore
From your command line issue the following command in the directory that contains the keystore.
keytool -list -keystore example.jks
17
Figure 79
This will list one or more entries which each column in the entry delimited by a comma. The first column in the entry is the key alias.
In the above example the key alias is mykey.
PKCS#12 k eystore
From your command line issue the following command in the directory that contains the keystore.
keytool -list -keystore example.pfx -storetype pkcs12
Figure 80
Chapter 17 Key management 223
Key management 17
This will list one or more entries which each column in the entry delimited by a comma. The first column in the entry is the key alias.
In the above example the key alias is mykey.
See also
Exporting a certificate, public or private key
You may export existing server key certificates and/or public keys for use by clients in validating trusted
FTPS, SFTP and HTTPS servers or for having a third party certificate authority e.g. Thawte, Verisign or
JSCAPE sign your certificate. To export an existing server certificate and/or public key open the Key
Manager by selecting the Server > Key Manager... option from the main menu. The Key Manager will be displayed. Click on Server Keys tab, select a server key and click on the Export button. The
Export dialog is displayed.
Figure 158
224 Chapter 17 Key management
Key management 17
Figure 64
Certificate filename - The filename to export the certificate to.
Format - The format in which to export certificate.
Figure 159
Chapter 17 Key management 225
Key management
Key filename - The filename to export public key file to.
Format - The format in which to export public key.
Figure 190
17
Key filename - The filename to export private key file to.
Password - The password used to protect the private key.
Format - The format in which to export private key.
Host keys
Enter topic text here.
226 Chapter 17 Key management
Key management 17
Overview
Host keys are the keys which are used to verify the identity of remote hosts. These may include public keys for SSL certificates used to protect FTPS and HTTPS services as well as public host keys for SSH/
SFTP services. Host keys may be associated with trading partners and/or used in certain trigger actions that perform secure file transfers to verify the identity of remote hosts.
Importing a host key
You may import existing certificates or public key for use in validating the identity of remote hosts in secure client connections. To import an existing certificate or public key open the Key Manager by selecting the Server > Key Manager... option from the main menu. The Key Manager will be displayed. Select the Host Keys tab and click on the Import button. The Import dialog is displayed.
Figure 69
Key alias - The local alias which will be used for storing in the servers local keystore. This may be any value of your choice.
Key file - The source certificate/public key file path to import from.
Exporting a host key
To export an existing host key certificate or public key open the Key Manager by selecting the Server
> Key Manager...
option from the main menu. The Key Manager will be displayed. Select the Host
Keys tab, select a key and click on the Export button. The Export dialog is displayed.
Figure 158
Chapter 17 Key management 227
Key management 17
Figure 64
Certificate file - The path to export the certificate to.
Format - The format in which to export certificate.
Figure 159
228 Chapter 17 Key management
Key management 17
Key file - The path to export public key file to.
Format - The format in which to export public key.
Client keys
Overview
Client keys are used for enhanced authentication of clients when connecting to JSCAPE MFT Server. For example, you may specify that your service requires that the user provide both a password and private key during the authentication process in order to be granted access. This is more secure form of authentication than simple password authentication as it requires a secondary token (a private key) in addition to the password.
Client keys may be used in the FTPS (FTP over SSL) and SFTP (FTP over SSH) secure file transfer protocols.
Note
Not all FTP/SFTP clients support authenticating with keys, so check your file transfer client documentation for details.
See also
Importing a certificate and/or public key
Exporting a certificate and/or public key
Generating a key
To generate a client key open the Key Manager by selecting the Server > Key Manager... option from the main menu. The Key Manager will be displayed.
Figure 22
Chapter 17 Key management 229
Key management 17
Step 1
Select the Client Keys tab and click on the Generate button. The Generate Client Key dialog is displayed.
Figure 66
230 Chapter 17 Key management
Key management 17
Key alias - Alias you wish to assign to the key.
Key algorithm - The algorithm used in generating this key. Valid options are RSA and DSA.
Key length - The length of the key in bytes. Valid options are 1024 and 2048.
Validity - The number of days this key is valid.
Common name - The name you wish to assign this key. For a client key this is typically the full name of the user e.g. John Smith.
Organizational unit - The unit within the users organization that this key will be used for e.g. IT.
Organization - The users organization name.
Locality - The users city.
State/Province - The users state or province.
Country - The users 2 character country code e.g. US.
Step 2
Export private key. Exported file may be imported by FTPS and SFTP clients for optional use in client authentication.
Figure 68
Key file - The file you wish to export private key to.
Password - The password used to protect private key. Leave blank for no password.
Format - The format in which you wish to export private key.
Chapter 17 Key management 231
Key management 17
Importing a certificate and/or public key
You may import existing certificates or public key for use in authenticating secure client connections using
FTPS (FTP over SSL) and SFTP (FTP over SSH) connections or encrypting files using OpenPGP. To import an existing certificate or public key open the Key Manager by selecting the Server > Key
Manager...
option from the main menu. The Key Manager will be displayed. Select the Client
Keys tab and click on the Import button. The Import dialog is displayed.
Figure 69
Key alias - The local alias which will be used for storing in the servers local keystore. This may be any value of your choice.
Key file - The source certificate/public key file path to import from.
Exporting a certificate and/or public key
To export an existing client certificate open the Key Manager by selecting the Server > Key
Manager...
option from the main menu. The Key Manager will be displayed. Select the Client
Keys tab, select a certificate and click on the Export button. The Export dialog is displayed.
Figure 104
232 Chapter 17 Key management
Key management 17
Figure 188
Certificate file - The filename to export the certificate to.
Format - The format in which to export certificate.
Figure 189
Chapter 17 Key management 233
Key management 17
Key file - The filename to export public key file to.
Format - The format in which to export public key.
OpenPGP keys
Overview
JSCAPE MFT Server includes built-in support for PGP and works with many popular PGP clients. PGP is typically used to provide an additional layer of security on top of any network protocol security (e.g. SSL,
SSH) that may be used. A common scenario is to PGP encrypt all files automatically upon successful upload to the server. This ensures that in the unlikely event your server is compromised, the attacker would still be unable to view PGP encrypted files without having the secret key needed to decrypt them.
Using PGP to encrypt files at rest is a common way of meeting government compliance standards such as the PCI DSS standard used for protecting credit card information.
Additional libraries needed for OpenPGP
Encrypting files and virtual paths
234
PGP encryption primer
PGP is a method of protecting digital content using a pair of PGP keys. PGP encryption makes it nearly impossible for someone to view the contents of an encrypted file without possessing the secret key and key password needed to decrypt the file.
Getting started
To begin, you must create a PGP key pair. This key pair consists of both a private key and public key.
This key pair can be created using the tools provided in JSCAPE MFT Server or by using any of the supported third party PGP clients. The private key is yours to keep and may be used for decryption and optional signing of digital documents. The private key should be safely guarded and is typically protected with a password that only you know. The public key is what you distribute to those individuals/ organizations with whom you wish to exchange encrypted content.
Chapter 17 Key management
Key management 17
To encrypt a document the sender encrypts the document using the recipients public key, then optionally signs the encrypted document with the senders private key. Signing the encrypted document proves to the recipient that the sender is who they say they are. All document encryption/signing in JSCAPE MFT
Server is performed via a trigger and the PGP Encrypt File action.
To decrypt a document the recipient decrypts the file using the recipients private key/password and optionally verifies the sender using the public key that was provided to the recipient by the sender. All file decryption in JSCAPE MFT Server is performed via a trigger and the PGP Decrypt File action.
PGP usage
Some typical uses of PGP in JSCAPE MFT Server include:
Automatically PGP encrypt/sign files upon upload ensuring data is protected while at-rest.
Automatically PGP decrypt/verify files upon upload.
Send PGP encrypted email messages to protect sensitive data.
See also
PGP compatibility matrix
The following is a PGP client compatibility matrix. The following PGP clients and functions have been tested successfully with JSCAPE MFT Server.
Client
PGP Desktop 9.x (and above)
Key Algorithm
DSA ElGamal
PGP Desktop 9.x (and above)
RSA
GPG 1.4.x (and above) DSA ElGamal
GPG 1.4.x (and above) RSA
Encrypt
Yes
Yes
Yes
Yes
Decrypt
Yes
Yes
Yes
Yes
Definitions
Decrypt - Create an OpenPGP key in JSCAPE MFT Server Key Manager or via web interfac. Import resulting public key into PGP client. Encrypt file using PGP client. Decrypt File using JSCAPE MFT
Server PGP Decrypt File action.
Encrypt - Create a private key in PGP client. Import corresponding public key into JSCAPE MFT Server
Key Manager under OpenPGP keys tab. Encrypt file using JSCAPE MFT Server PGP Encrypt File action.
Decrypt file using PGP client.
Note
Chapter 17 Key management 235
Key management
In order to use PGP successfully with JSCAPE MFT Server you must properly install the Unlimited
Jurisdiction Policy Files. For more information on this topic please see the following.
17
See also
Additional libraries needed for OpenPGP
Generating a key pair
PGP key pairs may be generated from either the Key Manager available in JSCAPE MFT Server Manager or via the My Account > OpenPGP Encryption > Generate OpenPGP Key link in the web interface. Keys imported via the Key Manager are system keys that may be used anywhere in the system, whereas keys imported via the web interface are private to the user that imported the key and may be used only to encrypt files uploaded to virtual paths that are accessible to the user and have PGP encryption enabled.
Generating a key pair via Key Manager
To generate a PGP key pair click the Server > Key Manager menu option in JSCAPE MFT Server
Manager. The Key Manager is displayed. Select the PGP Keys tab and click the Generate button.
The Generate PGP Key dialog is displayed.
Figure 108
236
Key algorithm - The type of key used. Valid values are RSA or DSA.
Can encrypt - Indicates whether key can be used for encrypt operations.
Can decrypt - Indicates whether key can be used for decrypt operations.
Can sign - Indicates whether key can be used for sign operations.
Can verify - Indicates whether key can be used for verify signature operations.
Fingerprint - The unique fingerprint for the key.
Figure 109
Chapter 17 Key management
Key management 17
Real name - The full name of the key pair owner e.g. John Smith.
Email - The email address for the key pair owner e.g. [email protected]
Key algorithm - The encryption algorithm used.
Key length - The length of encryption key.
Generating a key pair via web interface
To generate a key pair login via web interface and click on the My Account > OpenPGP Encryption
> Generate OpenPGP Key link. The Generate OpenPGP Key dialog is displayed.
Upon clicking the Generate button you will be prompted to save the private key on your local system.
Make sure to save this key in a safe place as without it you will be unable to decrypt files encrypted using the public key. Furthermore, anyone who obtains your private key may be able to decrypt your PGP encrypted files so it is recommended that you apply a password to your private key.
You will notice that upon generating your PGP key pair that a file named .pgp/key.pub will be placed in your home directory. DO NOT DELETE this file as it will be used for encrypting files uploaded to virtual paths that have PGP encryption enabled. Note only one PGP public key may be associated with each account. Generating a new key pair or importing a new public key will overwrite the existing public key file.
Figure 153
Chapter 17 Key management 237
Key management 17
Real name - The full name of the key pair owner e.g. John Smith.
Email - The email address for the key pair owner e.g. [email protected]
Key length - The length of encryption key.
Key algorithm - The encryption algorithm used.
File password - Optional private key password.
Importing public key
Using JSCAPE MFT Server Manager you can import an existing public PGP key. A typical scenario in which you would import a PGP public key would be the case where you want JSCAPE MFT Server to PGP encrypt documents using a PGP public key provided to you by a third party.
PGP key pairs may be imported from either the Key Manager available in JSCAPE MFT Server Manager or via the My Account > OpenPGP Encryption > Import Public Key link in the web interface.
Keys imported via the Key Manager are system keys that may be used anywhere in the system, whereas keys imported via the web interface are private to the user that imported the key and may be used only to encrypt files uploaded to virtual paths that are accessible to the user and have PGP encryption enabled.
Importing public keys via Key Manager
To import a PGP public key click the Server > Key Manager menu option in JSCAPE MFT Server
Manager. The Key Manager dialog is displayed. Select the PGP Keys tab and click the Import button. The Import PGP Key dialog is displayed.
Figure 110
238 Chapter 17 Key management
Key management 17
Key file - The PGP public key file.
Importing public keys via web interface
To import a public key login via web interface and click on the My Account > OpenPGP Encryption
> Import Public Key link. The Import OpenPGP Key dialog is displayed.
You will notice that upon generating your PGP key pair that a file named .pgp/key.pub will be placed in your home directory. DO NOT DELETE this file as it will be used for encrypting files uploaded to virtual paths that have PGP encryption enabled. NOTE only one PGP public key may be associated with each account. Generating a new key pair or importing a new public key will overwrite the existing public key file.
Figure 154
Chapter 17 Key management 239
Key management 17
Public key - Location of public key on local system.
Exporting public and private keys
Using JSCAPE MFT Server Manager you can export an existing public PGP key. A typical scenario in which you would export a PGP public key would be the case where you want to distribute your public key to individuals/organizations who will then use your public key for encrypting documents that they then send to you for decryption.
To export a PGP public key click the Server > Key Manager menu option in JSCAPE MFT Server
Manager. The Key Manager is displayed. Select the PGP Keys tab, select the key alias you wish to export, then click the Export button. The Export PGP Key dialog is displayed.
Figure 160
240 Chapter 17 Key management
Key management 17
Figure 161
Key file - The private key.
File password - Optional password used to protect private key.
Figure 162
Chapter 17 Key management 241
Key management 17
Key file - The public key file.
Encrypting files and virtual paths
Files uploaded to JSCAPE MFT Server may be encrypted using a trigger listening for the File Upload event and the PGP Encrypt File action, or by enabling PGP encryption for a virtual directory. Triggers are recommended when you want to limit encryption of files to certain conditions e.g. filename, file type, etc. Enabling PGP encryption at the virtual path is recommended when you want to encrypt all files uploaded to a certain virtual path.
Encrypting files using triggers
For more information on encrypting files using triggers see the documentation on triggers and the inline help for the File Upload event and PGP Encrypt File action.
See also
Encrypting files using virtual paths
To PGP encrypt all files uploaded to a virtual path select the virtual path for the user or group and click
Edit . Next, enable the PGP encrypt uploads option and click the Settings button. Here you will be prompted for which key to use when encrypting files. You may select either a system key that has been generated via the Key Manager in JSCAPE MFT Server Manager or a personal key that was created using the web interface.
Figure 155
242 Chapter 17 Key management
Key management 17
Figure 156
Chapter 17 Key management 243
Key management 17
Decrypting files
Files uploaded to JSCAPE MFT Server may be decrypted using a trigger listening for the File Upload event and the PGP Decrypt File action,
For more information on decrypting files using triggers see the documentation on triggers and the inline help for the File Upload event and PGP Decrypt File action.
See also
Server Settings
Overview
Server > Settings controls various global configuration properties and server side settings for
JSCAPE MFT Server Service. To access, select the Server > Settings menu item from the main menu.
Figure 164
244 Chapter 17 Key management
JSCAPE MFT Server Manager
Settings
Manager service settings
18
The Manager Service node may be used to change the administrative password for the JSCAPE MFT
Server Service as well as other properties.
Figure 164
Host/IP - The IP address that the JSCAPE MFT Server Service is running on.
Port - The port that the JSCAPE MFT Server Service is running on.
Timeout - Manager timeout in seconds when communicating with JSCAPE MFT Server Service.
Figure 107
Chapter 18 JSCAPE MFT Server Manager Settings 245
JSCAPE MFT Server Manager
Settings
18
Authentication timeout - The amount of time in seconds that administrative service client may remain connected without authenticating.
Block IP after - Blocks a client IP address after X invalid authentication attempts within Y minutes.
As an improved security measure you may define what IP addresses are allowed or disallowed access to access the administrative service.
IP mask examples
Examples of valid IP masks are as follows:
192.168.1.1
- Allows/Blocks a single IP address
192.168.1.* - Allows/Blocks all IP addresses in a class C IP block.
192.168.*.* - Allows/Blocks all IP addresses in a class B IP block.
*.*.*.* - Allows/Blocks all IP addresses.
Web settings
The Web node controls whether HTTP/S services are enabled and the ports they are running on. By enabling the HTTP/S service(s) users may use the web based JSCAPE MFT Server Web Gateway to perform file transfers. All domains share the same HTTP/S service settings.
Figure 19
246 Chapter 18 JSCAPE MFT Server Manager Settings
JSCAPE MFT Server Manager
Settings
18
Web Server
HTTP on host - The host and port you want to enable HTTP service on. This will also be used for client
REST services.
HTTPS on host - The host and port you want to enable HTTPS service on. This will also be used for client
REST services.
REST HTTP on host - The host and port you want to enable REST management services on.
REST HTTPS on host - The host and port you want to enable REST management services on.
HTTPS
Private key - The SSL encryption key to be used for HTTPS services.
HTTPS client certificate required - Requires that client browser successfully identify itself with a client certificate found in "Client keys" section of Key Manager.
SSL/TLS Ciphers - List of enabled SSL ciphers for HTTPS communications.
Miscellaneous
Connections
Server name - Optional value if entered will replace any HTTP headers that contain hostname data with specified hostname. This is useful in cases where server operates behind a NAT enabled firewall and you do not want to leak internal hostname or IP address information.
Redirect HTTP requests to HTTPS - Automatically redirects HTTP requests to HTTP.
Chapter 18 JSCAPE MFT Server Manager Settings 247
JSCAPE MFT Server Manager 18
Settings
Include service ports in HTTP/S headers - If enabled, service ports will be included in HTTP/S headers.
These may be disabled in cases where HTTP/S services are running on non-standard ports with some sort of port forwarding firewall located in front of server.
UI
User interface - Sets what user interface options are available from login page.
Default domain - Defaults domain field to specified value when logging in via web interface.
Hide domain - Hides domain field when logging in via web interface. If this option is checked then a default domain MUST be provided.
Show domain dropdown - If enable a drop-down list of available domains will be shown on login page.
Show lost password link - If enabled the "Lost password" link will be displayed on web interface login page allowing user to reset their password via email.
Self Registration
Show user registration link - If enabled users the user registration link will be provided on the main login page allowing users to self-register for accounts provided this is enabled for the domain.
Use email as login - If enabled, users will not be prompted for a username when self-registering, instead it will use their email address as their login when creating their account.
See also
248
Email settings
The Email node controls whether ad-hoc email transfers are enabled and the SMTP server settings used for sending emails.
See also
Failover settings
The Failover node controls whether a failover server is defined for this server.
See also
Search index settings
The Search Index node controls whether and how files are indexed for use in performing searches.
Figure 129
Chapter 18 JSCAPE MFT Server Manager Settings
JSCAPE MFT Server Manager
Settings
18
Re-index files every X hrs - Controls the frequency in which user/group virtual directories flagged for indexing are automatically re-indexed.
Update index upon file upload - If checked, file is automatically indexed upon upload.
Update index upon file rename - If checked, file is automatically re-indexed upon rename or deletion.
Update index upon account update - If checked, virtual directories for account are automatically indexed upon account update.
Update index upon group update - If checked, virtual directories for group are automatically indexed upon group update.
JDBC settings
The JDBC Drivers node controls what JDBC drivers may be used by JSCAPE MFT Server when storing account and/or log information in a relational database.
Figure 73
Chapter 18 JSCAPE MFT Server Manager Settings 249
JSCAPE MFT Server Manager
Settings
18
JDBC driver downloads
Microsoft SQL Server JDBC Driver http://msdn.microsoft.com/en-us/sqlserver/aa937724.aspx
Oracle JDBC Driver http://www.oracle.com/technology/tech/java/sqlj_jdbc/index.html
MySQL JDBC Driver http://dev.mysql.com/downloads/connector/j/5.1.html
Adding a JDBC driver
1. Place the JDBC driver JAR file in the libs/jdbc directory of your JSCAPE MFT Server installation.
2. Shutdown JSCAPE MFT Server Manager and JSCAPE MFT Server Service.
3. Restart JSCAPE MFT Server Manager and JSCAPE MFT Server Service.
4. From JDBC drivers panel click on the Add button. When prompted enter the JDBC driver class and press enter.
250 Chapter 18 JSCAPE MFT Server Manager Settings
© Copyright JSCAPE 1999-2014.
All rights reserved.
Product and company names mentioned in this manual may be trademarks or registered trademarks of their respective companies.
Mention of third-party products is for informational purposes only and constitutes neither an endorsement nor a recommendation.
The author assumes no responsibility w ith regard to the performance or use of these products. All understandings, agreements, or w arranties, if any, take place directly betw een the vendors and the prospective users. Every effort has been made to ensure that the information in this manual is accurate. The author is not responsible for printing or clerical errors.
The product described in this manual incorporates copyright protection technology that is protected by method claims of certain U.S. patents and other intellectual property rights.
This user manual w as created w ith Help &
Manual.
252
Index
D
Directory Monitor Deleted 143
Lejupielādēt
Publiskā saite ir atjaunināta
Ir atjaunināta publiskā saite uz jūsu tērzēšanu. You may view and manage your chat links after registration here.
Dokumenta publiskā saite
Reklāma
