Overview
A fresh installation of JSCAPE MFT Server will not be able to service any file transfer requests initially. A domain must first be created and configured before it can accept connections. A domain is created and managed using JSCAPE MFT Server Manager application. Please follow this guide on Launching JSCAPE MFT Server Manager for your operating system.
If after launching JSCAPE MFT Server Manager you get the error below please make sure you have JSCAPE MFT Server service running on the host you are trying to manage. Please follow this guide on Starting JSCAPE MFT Server service for your operating system.
Creating a domain using JSCAPE MFT Server Manager
Below is the initial JSCAPE MFT Server Manager screen when connected to a JSCAPE MFT Server service without any domain configured.
To create a new domain, click on “File > New Domain…” from the menu.
The “New Domain Wizard” screen should come up.
Enter a name for the domain and a description. Only the name is required and it will be permanent once the domain is created so choose the name carefully.
Click on the “Next >>” button to get to the Service configuration screen.
The service defined here will become the initial service for the domain. Additional services may be added after the domain has been created.
There are four service types to choose from: FTP, SFTP, HTTP and WebDAV. Depending on the service type chosen the following options will be available.
FTP / SFTP
Host – The default value of 0.0.0.0 means the service will listen on all existing interfaces. Unless you want to restrict the service to listen to a specific interface you would want to keep the default value. Please note that if you set this to 127.0.0.1 the service will not be able to accept connections from outside.
Port – The port on which the service will listen on. The default value is a known default for the service, 21 for FTP and 22 for SFTP. Unless you have some special need like running JSCAPE MFT Server as a non-root user under Linux/Solaris/Mac OS X you would want to keep the default value.
Authentication (SFTP only) – Determines which authentication method the server will use to authenticate a client. Possible methods are password, publickey, "password OR publickey" and "password AND publickey". password will only authenticate using the user's password. publickey will only authenticate using a user's private key with a public key deployed in the server. "password OR publickey" will use either. "password AND publickey" will use both.
Type (FTP only) – Possible types are regular, explicit SSL, forced explicit SSL and implicit SSL. Regular is the original, standard FTP. All FTP clients will be able to connect to it but it is not secure. The other three types are all secure and differ only in the initial client-server connection negotiation. When choosing among the three you will want to take into account the client software that will be used to connect to the service as not all clients support all three methods.
Private key – The key used to secure the transfer. Please note that the sample key that came with JSCAPE MFT Server is self-signed and might cause the client application to issue a warning.
HTTP
When done configuring the service click on the “Next >>” button to get to the Logging configuration screen.
The Logging configuration screen is where logs of authentications, transfers and service startups/shutdowns are written. There are two logging types to choose: File Log which write logs into a file within the filesystem and Database Log which write logs into a table named “log” within a database. The table must be created manually. JSCAPE MFT Server comes with three SQL scripts for Oracle, MSSQL or MySQL databases found under %installdir%/etc. A JDBC driver must be placed inside %installdir%/libs and the JDBC driver class registered under "File > Settings > JDBC Drivers"
Depending on the service type chosen the following options will be available.
File Log
Log Directory – The directory where the log files will be located.
Rotate Logs – The frequency in which log files are rotated. Could be time based, Daily/Weekly/Monthly or based on when the log file reached a given size.
Database Log
JDBC URL – The JDBC URL used to connect to the database where the “log” table reside
User – The database user used to connect to the database
Password – The user password
Pool size – The number of connections to keep in the connection pool
Time-to-live - The number of minutes
Click on the “Next >>” button to get to the Datastore configuration screen.
Datastore is where user and group account informations are stored. There are three types of datastores: File Record Datastore, File Datastore and DB Datastore. The first two uses filesystem files to store the information. The latter uses two database tables named accounts and groups to store user and group information respectively. The tables must be created manually. JSCAPE MFT Server comes with three SQL scripts for Oracle, MSSQL or MySQL databases found under %installdir%/etc. A JDBC driver must be placed inside %installdir%/libs and the JDBC driver class registered under "File > Settings > JDBC Drivers"
Click on the “OK” button to create the domain. The screen below is shown after the domain is created. At this point the initial service would have been started but no one would be able to connect until Authentication has been successfully configured.
Overview
JSCAPE MFT Server supports multiple ciphers for the SFTP service. This article will serve as a guide on how to enable these ciphers including downloading and setting up Sun’s “unlimited strength” JCE policy files that lift restrictions on allowable cryptographic strengths.
Configuring ciphers for the SFTP service
Ciphers for the SFTP service are configured using the JSCAPE MFT Server Manager application. Please follow this guide on Launching JSCAPE MFT Server Manager for your operating system.
Click on “Services” under the domain you want to manage then click on the “SFTP” tab and then click on “Ciphers” tab. By default only blowfish-cbc and 3des-cbc ciphers are enabled. To enable/disable a cipher just double-click on it to toggle the checkbox and then click on the “Apply” button.
The ciphers blowfish-cbc, 3des-cbc and none are supported by the SFTP service without additional setup but while the JSCAPE MFT Server Manager application allow the ciphers AES, Serpent, IDEA and CAST to be enabled they require additional setup for them to actually work. Please see below for details.
Setting up the Unlimited Strength Java(TM) Cryptography Extension Policy Files.
Due to import control restrictions, the version of JCE policy files that are bundled in the JDK environment allow "strong" but limited cryptography to be used.
If you are planning on using AES, Serpent, IDEA and CAST ciphers for SFTP service then you will need to download and setup Sun’s Unlimited Strength Java(TM) Cryptography Extension Policy Files. Please note that while the JSCAPE MFT Server Manager application allow these ciphers to be enabled they will not work without the Unlimited Strength JCE Policy Files installed.
Download the Unlimited Strength Jurisdiction Policy Files here:
http://java.sun.com/javase/downloads/index_jdk5.jsp#docs (JVM 1.5)
http://java.sun.com/javase/downloads/index.jsp (JVM 1.6)
Uncompress and extract the downloaded file. This will create a subdirectory called jce. Inside this directory, open the file “README.txt” and follow the instructions for installing the policy files in your environment.
You will need to restart JSCAPE MFT Server service for the policy files to take effect.
Testing a specific cipher
Using a system with OpenSSH installed (e.g Linux, Mac OSX) you could quickly test a specific cipher enabled on a JSCAPE MFT Server’s SFTP service using the sftp command line client that comes with OpenSSH. Please note that not all ciphers supported by the SFTP service is supported by OpenSSH’s sftp client and vice versa.
To do the test issue the following on a terminal window:
$ sftp -oCiphers=<cipher> <JSCAPE MFT Server host/ip>
Example
$ sftp -oCiphers=aes256-cbc localhost
If you get prompted with a password then the cipher is enabled and working on JSCAPE MFT Server’s SFTP service. If however you get the following:
Connecting to localhost...
no matching cipher found: client aes256-cbc server blowfish-cbc,3des-cbc
Connection closed
This would mean the cipher has not been enabled.
You may also encounter the following error if the cipher is enabled but require the Unlimited Strength JCE Policy Files and it’s not installed:
Connecting to localhost...
Received disconnect from localhost: Application error.
Connection closed
Summary
The JSCAPE MFT Server Manager application makes it trivial to enable/disable a cipher for the SFTP service. The thing to remember is that when enabling AES, Serpent, IDEA and CAST ciphers you would need to install Sun’s Unlimited Strength JCE Policy Files.
References
http://www.jscape.com/secureftpserver/docs/index.htm
http://en.wikipedia.org/wiki/Cipher
http://en.wikipedia.org/wiki/Blowfish_(cipher)
http://en.wikipedia.org/wiki/Triple_DES
http://en.wikipedia.org/wiki/Advanced_Encryption_Standard
http://en.wikipedia.org/wiki/Serpent_(cipher)
http://en.wikipedia.org/wiki/CAST-128
http://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm
Overview
JSCAPE MFT Server Web Gateway is a web based file transfer client that comes built-in with JSCAPE MFT Server. It has most of the functionalities of a traditional FTP/SFTP client like the ability to upload files from the user’s local machine to the remote server, download files from the remote server to the user’s local machine and manage files on the remote server.
JSCAPE MFT Server Web Gateway is very easy to enable and setup using JSCAPE MFT Server Manager and being web based requires no additional client setup. All the client needs to be able to securely upload and download files is a browser, which is present in most modern operating system.
JSCAPE MFT Server Web Gateway has built in support for internationalization and allows customization of its text prompts and system messages.
This guide detail the steps in adding support for a new language and customizing the existing ones that came with JSCAPE MFT Server Web Gateway.
Internationalization
JSCAPE MFT Server Web Gateway comes with built-in support for five languages: English, German, Spanish, French and Russian. The server automatically detects the language setting of a client’s browser and adjusts its display accordingly. If a client’s language setting is unsupported the default language is used. The default language is English. Please note that you can add language support for most languages. Please see details below.
Adding support for a new language
To add support for a new language you will use JSCAPE MFT Server Manager. JSCAPE MFT Server Web Gateway has two distinct components, the login page and the file transfer UI. It’s only relevant to note the distinction, as it may not be immediately apparent that the text prompts and system messages for each component are configurable within separate though almost similar language screens.
The login page is shown when a user accesses the URL of JSCAPE MFT Server Web Gateway and has not been authenticated. The screenshot below shows the login page in English.
To add support for a new language within the login page, click “File > Settings > Web” then click on the “Resources” tab
Then click on the “Add Language” button. The “New Language” dialog box should pop-up. Click on the “Language” drop-down and choose a language to add and then click on the “OK” button.
The new language will be added with all the values under the “Name / Value” properties list initialized to English. You would need to modify these accordingly. Please note that the “Name” column is an internal key used by the system and cannot be modified. It’s the “Value” column that needs to be modified. You can modify its value by double-clicking on it.
The file transfer UI of JSCAPE MFT Server Web Gateway is used by both the HTTP and WebDAV services. The screenshot below shows the file transfer UI in English.
To add support for a new language within the file transfer UI, you would need to access the separate language screens for these services. Click on “Services” under the domain you want to manage and then click on “HTTP” tab to get to the HTTP service configuration screen then click on “Add Language” button.
For WebDAV service click on “WebDAV” tab and click on “Add Language” button.
These language configuration screens behave exactly like the login page language configuration screen. Please follow the steps mentioned above.
Existing language customization
The default text prompts and system messages that came with the preconfigured languages (English, German, Spanish, French and Russian) can also be customized. Please follow the steps mentioned above to get to the corresponding language configuration screens for both login page and file transfer UI then select a preconfigured language to modify.
File transfer UI customization
The configuration screen of both HTTP and WebDAV services contain settings that can be used to customize the behavior of the file transfer UI.
For HTTP service (see HTTP service configuration screen above):
Connection timeout - The connection timeout for HTTP requests in minutes.
Enable web document viewer - If checked, enables the web document viewer. Shows the View button.
Use Flash upload component - If enabled, the Macromedia Flash plug-in will be used for performing file uploads.
Enable automatic logout - If checked, user will be automatically logged out when inactive for the given number of minutes and grace period.
Logout URL - The URL to redirect user to upon clicking Logout link.
Show buttons shortcuts - If checked, show the function key shortcuts for View, Rename, Refresh, New Directory, Delete buttons.
Show login info - If checked, shows the username and domain of currently logged on user.
Show search - If checked searches on indexed documents may be performed.
Show ASCII/Binary option - If checked, shows the ASCII and Binary transfer modes option. If unchecked, transfers are done in Binary mode.
Show account link - If checked, shows a link to My Account page, which allow users to modify their account.
For WebDAV service (see WebDAV service configuration screen above):
Enable Java applet - If checked, the Java applet interface is enabled.
Enable web document viewer - If checked, enables the web document viewer. Shows the View button.
Logout URL - The URL to redirect user to upon clicking Logout link.
Show login info - If checked, shows the username and domain of currently logged on user.
Show account link - If checked, shows a link to My Account page, which allow users to modify their account.
Summary
The JSCAPE MFT Server Web Gateway is a highly customizable and powerful component of the JSCAPE MFT Server. It provides a very capable file transfer client alternative with a uniform interface. It is centrally managed and thus enables zero client configuration.
References
Overview
Aside from the default file based method used to store user account information, JSCAPE MFT Server provides a method to store account information inside a database. Keeping account information inside a database could be a more robust alternative for some JSCAPE MFT Server installation with a significant number of users.
Initializing the database
JSCAPE MFT Server comes with three SQL scripts located under %installdir%/etc that can be used to create the necessary database tables that will hold user as well as group account information. The three scripts are mysql.sql, mssql.sql and oracle.sql for MySQL, MS SQL and Oracle databases respectively. They could easily be adapted to other RDBMSes as these scripts simply create tables named “accounts”, “groups” and “log”.
Below is a guide for executing the SQL script for the MySQL database. First create the MySQL database where the tables will reside and then create a MySQL user and grant that user appropriate database privileges. Connect to the MySQL server as root using an appropriate MySQL client (the command line client “mysql” will do) and issue the following commands:
create database jscapedb;
grant all privileges on jscapedb.* to jscape@'localhost' identified by 'jscape';
The above “grant…” command assumes that the JSCAPE MFT Server is on the same machine as the MySQL server. If they’re not then “localhost” must be changed to the hostname/IP address of the JSCAPE MFT Server. The database name (jscapedb) and username/password (jscape/jscape) used above are arbitrary values. Feel free to change them.
Once the MySQL database and user has been created, the create table script can be executed against that database. Using “mysql” command line client the following command could be issued:
mysql -u jscape -p -D jscapedb < %installdir%/etc/mysql.sql
%installdir% is where JSCAPE MFT Server is installed. Please quote accordingly if directory name contain spaces.
Setting up the JDBC driver
Before the JSCAPE MFT Server could connect and use the newly initialized database an approriate JDBC driver must be installed on its “libs” directory and configured.
First download the JDBC driver for your database and copy the JDBC driver jar file into %installdir%/libs.
To configure the JDBC driver open JSCAPE MFT Server Manager and go to “File > Settings… > JDBC Drivers”. Click on the “Add” button and enter the JDBC driver class name. Check on the documentation that came with the JDBC driver to know the approriate class name, for MySQL Connector/J used below the class name is com.mysql.jdbc.Driver.
Click on the “OK” button, quit JSCAPE MFT Server Manager and then restart the JSCAPE MFT Server service.
Configure JSCAPE MFT Server to store account information in a database
Open JSCAPE MFT Server and click on “Datastore” under the domain you want to manage.
Choose “DB Datastore” on the “Service type” drop-down list and fill-up the following parameters.
JDBC URL – The JDBC URL that will be used to connect to the database. This usually contains JDBC driver and database dependent information as well as the database server’s hostname/IP address and its name. The above screenshot shows a JDBC URL for MySQL database and Connector/J JDBC driver.
User - The database username used to authenticate with database.
Password - The password used to authenticate with database.
Pool size - The maximum number of connections to pool. Initiating a JDBC connection is resource intensive so keeping readily available connections minimizes that initialization.
Time-to-live - The maximum amount of time in minutes that the database connection can live in the pool without activity.
Test parameters - Tests database connection using the specified JDBC settings.
Summary
There is certainly some configuration overhead when using a database to store account information but there are definitely advantages that merit its use specially for installations with a significant number of users. For one, RDBMSes are more efficient at managing information like accounts and most enterprise already have a database server running on their network that is well maintained and backed up regularly so using that will automatically gain you a level of fault tolerance. As far as account information is concerned that is.
References
Storing account details in a database
JDBC Overview
JDBC Driver for MySQL (Connector/J)
Oracle JDBC Driver Downloads
Microsoft SQL Server JDBC Driver
