Managed File Transfer and Security Solutions

Creating a domain

Overview

A fresh installation of JSCAPE MFT Server will not be able to service any file transfer requests initially. A domain must first be created and configured before it can accept connections. A domain is created and managed using JSCAPE MFT Server Manager application. Please follow this guide on Launching JSCAPE MFT Server Manager for your operating system.

If after launching JSCAPE MFT Server Manager you get the error below please make sure you have JSCAPE MFT Server service running on the host you are trying to manage. Please follow this guide on Starting JSCAPE MFT Server service for your operating system.

  

Creating a domain using JSCAPE MFT Server Manager

Below is the initial JSCAPE MFT Server Manager screen when connected to a JSCAPE MFT Server service without any domain configured.

To create a new domain, click on “File > New Domain…” from the menu.

The “New Domain Wizard” screen should come up.

Enter a name for the domain and a description. Only the name is required and it will be permanent once the domain is created so choose the name carefully.

Click on the “Next >>” button to get to the Service configuration screen.

The service defined here will become the initial service for the domain. Additional services may be added after the domain has been created.

There are four service types to choose from: FTP, SFTP, HTTP and WebDAV. Depending on the service type chosen the following options will be available.

FTP / SFTP

Host – The default value of 0.0.0.0 means the service will listen on all existing interfaces. Unless you want to restrict the service to listen to a specific interface you would want to keep the default value. Please note that if you set this to 127.0.0.1 the service will not be able to accept connections from outside.

Port – The port on which the service will listen on. The default value is a known default for the service, 21 for FTP and 22 for SFTP. Unless you have some special need like running JSCAPE MFT Server as a non-root user under Linux/Solaris/Mac OS X you would want to keep the default value.

Authentication (SFTP only) – Determines which authentication method the server will use to authenticate a client. Possible methods are password, publickey, "password OR publickey" and "password AND publickey". password will only authenticate using the user's password. publickey will only authenticate using a user's private key with a public key deployed in the server. "password OR publickey" will use either. "password AND publickey" will use both.

Type (FTP only) – Possible types are regular, explicit SSL, forced explicit SSL and implicit SSL. Regular is the original, standard FTP. All FTP clients will be able to connect to it but it is not secure. The other three types are all secure and differ only in the initial client-server connection negotiation. When choosing among the three you will want to take into account the client software that will be used to connect to the service as not all clients support all three methods.

Private key – The key used to secure the transfer. Please note that the sample key that came with JSCAPE MFT Server is self-signed and might cause the client application to issue a warning.

HTTP

 

When done configuring the service click on the “Next >>” button to get to the Logging configuration screen.

The Logging configuration screen is where logs of authentications, transfers and service startups/shutdowns are written. There are two logging types to choose: File Log which write logs into a file within the filesystem and Database Log which write logs into a table named “log” within a database. The table must be created manually. JSCAPE MFT Server comes with three SQL scripts for Oracle, MSSQL or MySQL databases found under %installdir%/etc. A JDBC driver must be placed inside %installdir%/libs and the JDBC driver class registered under "File > Settings > JDBC Drivers"

Depending on the service type chosen the following options will be available.

File Log

Log Directory – The directory where the log files will be located.

Rotate Logs – The frequency in which log files are rotated. Could be time based, Daily/Weekly/Monthly or based on when the log file reached a given size.

Database Log

JDBC URL – The JDBC URL used to connect to the database where the “log” table reside

User –  The database user used to connect to the database

Password – The user password

Pool size – The number of connections to keep in the connection pool

Time-to-live - The number of minutes

Click on the “Next >>” button to get to the Datastore configuration screen.

Datastore is where user and group account informations are stored. There are three types of datastores: File Record Datastore, File Datastore and DB Datastore. The first two uses filesystem files to store the information. The latter uses two database tables named accounts and groups to store user and group information respectively. The tables must be created manually. JSCAPE MFT Server comes with three SQL scripts for Oracle, MSSQL or MySQL databases found under %installdir%/etc. A JDBC driver must be placed inside %installdir%/libs and the JDBC driver class registered under "File > Settings > JDBC Drivers"

Click on the “OK” button to create the domain. The screen below is shown after the domain is created. At this point the initial service would have been started but no one would be able to connect until Authentication has been successfully configured.

Setting up ciphers for the SFTP service

Overview 

JSCAPE MFT Server supports multiple ciphers for the SFTP service. This article will serve as a guide on how to enable these ciphers including downloading and setting up Sun’s “unlimited strength” JCE policy files that lift restrictions on allowable cryptographic strengths.

Configuring ciphers for the SFTP service

Ciphers for the SFTP service are configured using the JSCAPE MFT Server Manager application. Please follow this guide on Launching JSCAPE MFT Server Manager for your operating system.

Click on “Services” under the domain you want to manage then click on the “SFTP” tab and then click on “Ciphers” tab. By default only blowfish-cbc and 3des-cbc ciphers are enabled. To enable/disable a cipher just double-click on it to toggle the checkbox and then click on the “Apply” button.

The ciphers blowfish-cbc, 3des-cbc and none are supported by the SFTP service without additional setup but while the JSCAPE MFT Server Manager application allow the ciphers AES, Serpent, IDEA and CAST to be enabled they require additional setup for them to actually work. Please see below for details.

 

Setting up the Unlimited Strength Java(TM) Cryptography Extension Policy Files.

Due to import control restrictions, the version of JCE policy files that are bundled in the JDK environment allow "strong" but limited cryptography to be used.

If you are planning on using AES, Serpent, IDEA and CAST ciphers for SFTP service then you will need to download and setup Sun’s Unlimited Strength Java(TM) Cryptography Extension Policy Files. Please note that while the JSCAPE MFT Server Manager application allow these ciphers to be enabled they will not work without the Unlimited Strength JCE Policy Files installed.

Download the Unlimited Strength Jurisdiction Policy Files here:

http://java.sun.com/javase/downloads/index_jdk5.jsp#docs (JVM 1.5)
http://java.sun.com/javase/downloads/index.jsp (JVM 1.6)

Uncompress and extract the downloaded file. This will create a subdirectory called jce. Inside this directory, open the file “README.txt” and follow the instructions for installing the policy files in your environment.

You will need to restart JSCAPE MFT Server service for the policy files to take effect.

 

Testing a specific cipher 

Using a system with OpenSSH installed (e.g Linux, Mac OSX) you could quickly test a specific cipher enabled on a JSCAPE MFT Server’s SFTP service using the sftp command line client that comes with OpenSSH. Please note that not all ciphers supported by the SFTP service is supported by OpenSSH’s sftp client and vice versa.

To do the test issue the following on a terminal window:

$ sftp -oCiphers=<cipher> <JSCAPE MFT Server host/ip>

Example

$ sftp -oCiphers=aes256-cbc localhost

If you get prompted with a password then the cipher is enabled and working on JSCAPE MFT Server’s SFTP service. If however you get the following:

Connecting to localhost...
no matching cipher found: client aes256-cbc server blowfish-cbc,3des-cbc
Connection closed

This would mean the cipher has not been enabled.

You may also encounter the following error if the cipher is enabled but require the Unlimited Strength JCE Policy Files and it’s not installed:

Connecting to localhost...
Received disconnect from localhost: Application error.
Connection closed

 

Summary

The JSCAPE MFT Server Manager application makes it trivial to enable/disable a cipher for the SFTP service. The thing to remember is that when enabling AES, Serpent, IDEA and CAST ciphers you would need to install Sun’s Unlimited Strength JCE Policy Files.

 

References

http://www.jscape.com/secureftpserver/docs/index.htm
http://en.wikipedia.org/wiki/Cipher
http://en.wikipedia.org/wiki/Blowfish_(cipher)
http://en.wikipedia.org/wiki/Triple_DES
http://en.wikipedia.org/wiki/Advanced_Encryption_Standard
http://en.wikipedia.org/wiki/Serpent_(cipher)
http://en.wikipedia.org/wiki/CAST-128
http://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm

Customizing Look and Feel of the Web Interface

Overview

JSCAPE MFT Server Web Gateway is a web based file transfer client that comes built-in with JSCAPE MFT Server. It has most of the functionalities of a traditional FTP/SFTP client like the ability to upload files from the user’s local machine to the remote server, download files from the remote server to the user’s local machine and manage files on the remote server.

JSCAPE MFT Server Web Gateway is very easy to enable and setup using JSCAPE MFT Server Manager and being web based requires no additional client setup. All the client needs to be able to securely upload and download files is a browser, which is present in most modern operating system.

JSCAPE MFT Server Web Gateway has built in support for internationalization and allows customization of its text prompts and system messages.

This guide detail the steps in adding support for a new language and customizing the existing ones that came with JSCAPE MFT Server Web Gateway.

Internationalization

JSCAPE MFT Server Web Gateway comes with built-in support for five languages: English, German, Spanish, French and Russian. The server automatically detects the language setting of a client’s browser and adjusts its display accordingly. If a client’s language setting is unsupported the default language is used. The default language is English. Please note that you can add language support for most languages. Please see details below.

Adding support for a new language

 To add support for a new language you will use JSCAPE MFT Server Manager. JSCAPE MFT Server Web Gateway has two distinct components, the login page and the file transfer UI. It’s only relevant to note the distinction, as it may not be immediately apparent that the text prompts and system messages for each component are configurable within separate though almost similar language screens.

The login page is shown when a user accesses the URL of JSCAPE MFT Server Web Gateway and has not been authenticated. The screenshot below shows the login page in English.

To add support for a new language within the login page, click “File > Settings > Web” then click on the “Resources” tab

Then click on the “Add Language” button.  The “New Language” dialog box should pop-up. Click on the “Language” drop-down and choose a language to add and then click on the “OK” button.

The new language will be added with all the values under the “Name / Value” properties list initialized to English. You would need to modify these accordingly. Please note that the “Name” column is an internal key used by the system and cannot be modified. It’s the “Value” column that needs to be modified. You can modify its value by double-clicking on it.

The file transfer UI of JSCAPE MFT Server Web Gateway is used by both the HTTP and WebDAV services. The screenshot below shows the file transfer UI in English.

To add support for a new language within the file transfer UI, you would need to access the separate language screens for these services. Click on “Services” under the domain you want to manage and then click on “HTTP” tab to get to the HTTP service configuration screen then click on “Add Language” button.

For WebDAV service click on “WebDAV” tab and click on “Add Language” button.

These language configuration screens behave exactly like the login page language configuration screen. Please follow the steps mentioned above.

Existing language customization

The default text prompts and system messages that came with the preconfigured languages (English, German, Spanish, French and Russian) can also be customized. Please follow the steps mentioned above to get to the corresponding language configuration screens for both login page and file transfer UI then select a preconfigured language to modify.

File transfer UI customization

The configuration screen of both HTTP and WebDAV services contain settings that can be used to customize the behavior of the file transfer UI.

For HTTP service (see HTTP service configuration screen above):

Connection timeout - The connection timeout for HTTP requests in minutes.
Enable web document viewer - If checked, enables the web document viewer. Shows the View button.
Use Flash upload component - If enabled, the Macromedia Flash plug-in will be used for performing file uploads.
Enable automatic logout - If checked, user will be automatically logged out when inactive for the given number of minutes and grace period.
Logout URL - The URL to redirect user to upon clicking Logout link.

Show buttons shortcuts - If checked, show the function key shortcuts for View, Rename, Refresh, New Directory, Delete buttons.
Show login info - If checked, shows the username and domain of currently logged on user.
Show search - If checked searches on indexed documents may be performed.
Show ASCII/Binary option - If checked, shows the ASCII and Binary transfer modes option. If unchecked, transfers are done in Binary mode.
Show account link - If checked, shows a link to My Account page, which allow users to modify their account.

For WebDAV service (see WebDAV service configuration screen above):

Enable Java applet - If checked, the Java applet interface is enabled.
Enable web document viewer - If checked, enables the web document viewer. Shows the View button.
Logout URL - The URL to redirect user to upon clicking Logout link.

Show login info - If checked, shows the username and domain of currently logged on user.
Show account link - If checked, shows a link to My Account page, which allow users to modify their account.

Summary

The JSCAPE MFT Server Web Gateway is a highly customizable and powerful component of the JSCAPE MFT Server. It provides a very capable file transfer client alternative with a uniform interface. It is centrally managed and thus enables zero client configuration.

References

Web based file transfers

Using a Database Datastore to Store User Information

Overview

Aside from the default file based method used to store user account information, JSCAPE MFT Server provides a method to store account information inside a database. Keeping account information inside a database could be a more robust alternative for some JSCAPE MFT Server installation with a significant number of users.

Initializing the database

JSCAPE MFT Server comes with three SQL scripts located under %installdir%/etc that can be used to create the necessary database tables that will hold user as well as group account information. The three scripts are mysql.sql, mssql.sql and oracle.sql for MySQL, MS SQL and Oracle databases respectively. They could easily be adapted to other RDBMSes as these scripts simply create tables named “accounts”, “groups” and “log”.

Below is a guide for executing the SQL script for the MySQL database.  First create the MySQL database where the tables will reside and then create a MySQL user and grant that user appropriate database privileges. Connect to the MySQL server as root using an appropriate MySQL client (the command line client “mysql” will do) and issue the following commands:

create database jscapedb;

grant all privileges on jscapedb.* to jscape@'localhost' identified by 'jscape';

The above “grant…” command assumes that the JSCAPE MFT Server is on the same machine as the MySQL server. If they’re not then “localhost” must be changed to the hostname/IP address of the JSCAPE MFT Server. The database name (jscapedb) and username/password (jscape/jscape) used above are arbitrary values. Feel free to change them.

Once the MySQL database and user has been created, the create table script can be executed against that database. Using “mysql” command line client the following command could be issued:

mysql -u jscape -p -D jscapedb < %installdir%/etc/mysql.sql

%installdir% is where JSCAPE MFT Server is installed. Please quote accordingly if directory name contain spaces. 

Setting up the JDBC driver 

Before the JSCAPE MFT Server could connect and use the newly initialized database an approriate JDBC driver must be installed on its “libs” directory and configured.

First download the JDBC driver for your database and copy the JDBC driver jar file into %installdir%/libs.

To configure the JDBC driver open JSCAPE MFT Server Manager and go to “File > Settings… > JDBC Drivers”. Click on the “Add” button and enter the JDBC driver class name. Check on the documentation that came with the JDBC driver to know the approriate class name, for MySQL Connector/J used below the class name is com.mysql.jdbc.Driver.

Click on the “OK” button, quit JSCAPE MFT Server Manager and then restart the JSCAPE MFT Server service.

Configure JSCAPE MFT Server to store account information in a database

Open JSCAPE MFT Server and click on “Datastore” under the domain you want to manage.

Choose “DB Datastore” on the “Service type” drop-down list and fill-up the following parameters.

JDBC URL – The JDBC URL that will be used to connect to the database. This usually contains JDBC driver and database dependent information as well as the database server’s hostname/IP address and its name. The above screenshot shows a JDBC URL for MySQL database and Connector/J JDBC driver.

User - The database username used to authenticate with database.

Password - The password used to authenticate with database.

Pool size - The maximum number of connections to pool. Initiating a JDBC connection is resource intensive so keeping readily available connections minimizes that initialization.

Time-to-live - The maximum amount of time in minutes that the database connection can live in the pool without activity.

Test parameters - Tests database connection using the specified JDBC settings.

Summary 

There is certainly some configuration overhead when using a database to store account information but there are definitely advantages that merit its use specially for installations with a significant number of users. For one, RDBMSes are more efficient at managing information like accounts and most enterprise already have a database server running on their network that is well maintained and backed up regularly so using that will automatically gain you a level of fault tolerance. As far as account information is concerned that is.

References

Storing account details in a database
JDBC Overview
JDBC Driver for MySQL (Connector/J)
Oracle JDBC Driver Downloads
Microsoft SQL Server JDBC Driver

Using Database Query Authentication with Hashed Passwords

Overview

JSCAPE MFT Server offers a variety of user authentication methods most of which could leverage existing authentication infrastructure such as LDAP, NTLM and PAM. If you don’t have such existing infrastructure but instead have an existing application that authenticate users using a database table which most web applications do then you may use that same table to authenticate JSCAPE MFT Server users using database query authentication method.

Setting up the JDBC driver

Before the JSCAPE MFT Server could use database query authentication an approriate JDBC driver must be installed on its “libs” directory and configured.

First download the JDBC driver for your database and copy the JDBC driver jar file into %installdir%/libs.

To configure the JDBC driver open JSCAPE MFT Server Manager and go to “File > Settings… > JDBC Drivers”. Click on the “Add” button and enter the JDBC driver class name. Check on the documentation that came with the JDBC driver to know the approriate class name, for MySQL Connector/J used below the class name is com.mysql.jdbc.Driver.

Configuring Database Query Authentication

Open JSCAPE MFT Server and click on “Authentication” under the domain you want to manage.

JDBC URL – The JDBC URL that will be used to connect to the database. This usually contains JDBC driver and database dependent information as well as the database server’s hostname/IP address and its name. The above screenshot shows a JDBC URL for MySQL database and Connector/J JDBC driver.

User - The database username used to authenticate with the database.

Password / Confirm password - The password used to authenticate with the database.

SQL query - The SQL query to perform to authenticate the user. The authentication process exposes the username and password entered by the user as expansion variables named %username% and %password% for use within the SQL query. The expansion variables %username% and %password% are treated as strings so they MUST be enclosed in single quotes.

Note: Plain SELECT statement or stored procedures may be used, however stored procedures that make use of output parameters CANNOT be used.

Hash password class - The Java class to use for hashing the password before passing to SQL query. If no class is specified then password will be passed to SQL query in clear text. While this is optional it is highly recommended that password hashing be used. See “Password Hashing” below.

Create account if not found using template - This allows for accounts to be created automatically upon successful authentication. If selected, an account will be created automatically (if it does not exist already) using the specified User Template.

Password Hashing

Database query authentication supports hashing of the password entered by the user before passing and using it within the SQL query used to authenticate a user. This entails that passwords be in an equivalent hash digest inside the underlying table for the authentication to succeed.

This is highly recommended to prevent anyone that has access to the database and has SELECT privilege on the underlying table from seeing everyone’s password in clear text.

MD5 and SHA1 are two widely used cryptographic hash functions and are supported by JSCAPE MFT Server using the following hashing provider classes, com.jscape.inet.mft.authentication.MD5Hasher for MD5 and com.jscape.inet.mft.authentication.SHA1Hasher for SHA1.

Creating a custom password hashing provider class

If MD5 and SHA1 is not option or if you have an existing authentication table that uses a different hashing function then you can create your own hashing provider class.

To someone familiar with Java programming it is trivial to implement a hashing provider class. Please follow the following steps to implement your own hashing provider:

1. Create a Java class that implements the com.jscape.inet.mft.authentication.Hasher class.

2. Overload the public String createHash(String login, String password) method, returning the hashed value.

3. Create a JAR file that contains the compiled class of your com.jscape.inet.mft.authentication.Hasher implementation.

To compile your hashing provider class you will need to include the ftpserver.jar in your classpath. The ftpserver.jar may be found in the libs directory for JSCAPE Secure FTP Server.

4. Place the JAR file created in step 3 into the libs directory of your JSCAPE MFT Server installation.

5. Shutdown any open instances of JSCAPE MFT Server Manager and restart the JSCAPE MFT Server service.

6. In the "Hash password class" field of the "Database Query Authentication" service enter the full class name, including package name of your hash provider.

Summary

Database query authentication is a viable alternative to LDAP, PAM and NTLM authentication methods especially if you don’t have any of those already running. Its ability to authenticate using hashed passwords makes it on par with those methods.

References

Database Query Authentication
Cryptographic hash function
MD5
SHA-1

Restricting Access to the Server within Certain Time Periods

Overview

JSCAPE MFT Server provides a functionality to restrict access to the server on certain days and times. The functionality is very straight forward to enable and configure. Among other valid reasons such as enforcing company policy, this may also be ideal for administrators to quickly restrict access to the server while doing some minor housekeeping.

Configure Time Based Access

Open JSCAPE MFT Server Manager and click on “Time Access” under the domain you want to manage.

Click on the “Enabled” checkbox and click on the checkbox beside the days you want to limit access and specify the From/To time when the system will be available on those days. If you don’t want to limit access on a specific day then leave its checkbox unchecked.

There is no possibility to totally restrict access on a specific day but you could set the From/To fields to the same time and limit access for that day to a single minute, which is the closest you could get to total restriction.

Please note that day and time is based on server’s local time.

Summary

There maybe a few such instances where you want to restrict access to the server based on certain days and times but when the need does come up JSCAPE MFT Server will allow you configure such restriction easily.

References

Setting time based access

Banning File Uploads Based on Filenames

Overview

The ability to restrict file uploads based on filenames is a simple yet useful feature. JSCAPE MFT Server supports this feature using the powerful functionality of regular expressions.

Configure File Upload Banning Based on Filenames

Open JSCAPE MFT Server Manager and click on “Banned Files” under the domain you want to manage. Under the “Banned Files” tab click on the “Enabled” checkbox then click on the “Add” button and enter a regular expression that will be matched against the filename during upload.

In the screenshot above the regular expression entered, “.*\.[Vv][Bb][Ss]”, will match against files whose filenames end with the extension “.vbs”, “.VBS” or any upper/lower case combination of the text “vbs”. This is convenient when you have JSCAPE MFT Server running on an operating system that treats filenames as case-sensitive  (e.g. Solaris, Linux, OS X).

Please note that you are not limited to matching based on filename extensions. You can enter a regular expression that will match any part of a filename.

You can enter multiple regular expressions.

Summary

Banning file uploads based on filenames within JSCAPE MFT Server is simple and its use of regular expressions greatly enhance the effectivity of such a feature.

References

Setting banned files
Java’s java.util.regex.Pattern class
Using Regular Expressions in Java

Enabling Password Compliance

Overview

JSCAPE MFT Server provides a fine-grained password compliance configuration that enable strong passwords whether it be for meeting a government mandated standard like the Sarbanes–Oxley Act or a company wide policy that requires users to choose strong passwords.

Options like setting a minimum password length, expiring passwords, the inability for a user to reuse previous passwords and requiring that passwords contain a combination of uppercase, lowercase, numeric and special characters are available for administrators to enforce.

Enabling and Configuring Password Compliance

Open JSCAPE MFT Server Manager and click on “Compliance” under the domain you want to manage.

Minimum password length of - Requires that password not be shorter than the defined minimum length of characters.

Maximum password age of - Requires that user passwords expire and forced to be changed when the defined maximum number of days is reached. This option can be disabled at the user level where needed by using the "Ignore password aging rules" option.

Email password change reminder - Emails a password change reminder to the user when his/her password is about to expire. The reminder is to be sent on the defined number of days before the password is set to expire. To receive the reminder the user must have an email address defined. Also, before JSCAPE MFT Server can send emails an SMTP server must be defined.  The SMTP server is defined under “File > Settings > Email” in JSCAPE MFT Server Manager.

Password must not match previous - Requires that new passwords not match any of the previously used passwords. The number parameter defines how far back of previously used password will not be allowed reuse. 1 would mean the current password cannot be reused but the password before it , if any, would be eligible for reuse. 2 means both the current and the password before it cannot be reused. 100 is the maximum.

Deny login for password non-compliance - If enabled, user password will be verified at time of login to check that it meets compliance requirements. If it matches user password but does not meet compliance requirements then user will be denied login.

Summary

It has been said that the weakest security link in any system are the people using it. If you allow them, some people would choose the shortest, weakest and the easiest to guess passwords. Passwords like “god”, “sex”, “xxx”, “12345” ,“qwerty” are common and are the type of passwords that bring nightmares to administrators across the world.

The JSCAPE MFT Server can be configured to force users to choose strong passwords and not just rely on their willingness to do so. Passwords are an integral part in securing a system and sometimes users just need a little "coercion" to help them choose a better password.

References

Defining password compliance
Sarbanes–Oxley Act
COBIT

Detecting and Blocking Brute Force Password Attempts

Overview

JSCAPE MFT Server provides connection settings that help thwart brute force password attacks. It can be configured to block further insistent attacks coming from the same IP address and to disable the user account being used in the attack.

Configure IP Address Blocking and Account Disabling Due to Failed Login Attempts

Open JSCAPE MFT Server Manager and click on “Connections” under the domain you want to manage.

Disable account after X invalid password attempts in Y min for Z min – Disables an account for a certain period of time when the number of failed login attempts within a given period of time is reached.

Block IP after X invalid password attempts in Y min for Z min – Blocks an IP address from further access for a certain period of time when then number of failed login attempts coming from that IP address within a given period of time is reached.

Summary

Private servers perhaps like most JSCAPE MFT Server installations more often than not are put online over the Internet and even though they are meant to be accessed by private users authorized to use them they are nonetheless exposed to anyone connected to the Internet. Such exposure could bring with it attempts at unauthorized access. Most of these attempts would be crude, brute force attempts at guessing user passwords. The JSCAPE MFT Server connection settings makes it easy to thwart such insistent, unauthorized attempts but at the same time leave room for valid users experiencing temporary mental lapses during login attempts to retry.

References

Setting connection preferences

Handling Server Events and Responding Using Triggers

Overview

JSCAPE MFT Server provides a very powerful feature that allows users to define a function that listens to events occurring within the server and execute actions when certain conditions related to these events are met. This functionality is called a trigger.

JSCAPE MFT Server provides a comprehensive set of predefined events and actions that let’s you define triggers, which can automate trivial as well very complex tasks. From as simple as renaming the filename of a just received file to decrypting PGP encrypted files or downloading/uploading files from/to your trading partner’s server.

The ability to compound conditions and specify multiple actions within a single trigger allows one to define very powerful, precise functionalities.  

What Are Events?

Events are the things that occur throughout the course of a server’s runtime. Events like a user login/logout or a file upload being started. JSCAPE MFT Server exposes a comprehensive set of these events. These predefined events form the bases of a trigger definition.

What Are Event Properties?

Events have named properties that can be tested and used within actions. Each event has their own relevant set of named properties as well as properties that are common to all events. As an example, the “File Upload” event has a property named “Bytes” which is the size of the uploaded file and the “IP Blocked” event has a property named “IP” which correspond to the IP address just blocked. Example of common properties is “DomainName”, which is the name of the domain where the event occurred. Also common are the various date and time related properties corresponding to the data and time when the event occurred.

What Are Conditions?

Conditions are the criteria that must be met before actions defined within a trigger can be executed. Conditions are specified against named properties of an event. They can be compounded using “AND” and “OR” expression to form complex criteria.

What Are Actions?

Actions are predefined functions that get executed when all conditions specified on a trigger are met. JSCAPE MFT Server provides a comprehensive set of actions for use in a trigger. A trigger may be defined with multiple actions.

Custom actions can also be created by writing a Java class that extends the com.jscape.inet.mft.workflow.AbstractAction class within the JSCAPE Secure FTP Server Management API. See reference below.

Defining A Trigger

Open JSCAPE MFT Server and click on “Triggers” under the domain you want to manage. Then click on the “Add” button to get to the “New Trigger Wizard” screen.

Name - A unique name identifying the trigger.

Event Type - The type of event you want to listen for.

Description - Description of this trigger.

Enabled - Enables/disables trigger. By default this is checked.

Fire Trigger Error event if error occurs - If an error occurs while executing any of the actions associated with this trigger, a Trigger Error event will be raised. You may capture this event using a trigger that listens for the Trigger Error event and respond appropriately.

Click on the “Next >>” button to get to the “Trigger Condition” screen where you can specify the conditions to be met.

Condition Tree - Binary expression tree which lists all currently defined conditions. It has a root node with other internal nodes that are junctions (AND/OR statements) and leaf nodes that are constraints.

Condition - Text representation of the condition tree along with interface for managing junctions and leaf node constraints.

Update button - Updates condition tree with currently selected condition.

Clear button - Clears condition tree resulting in a single root node of true, indicating that this trigger will always evaluate to true and that all associated actions will be executed.

Test expression - Displays a "Test condition" dialog that allows you to enter sample values to test against your condition tree.

Click on the “Next >>” button to get to the “Trigger Action” screen where you can specify the actions that will be executed when the conditions are met.

Then click on the “Add” button to get to the “New Action” screen where you can choose an action to add

Different set of options appears depending on the action chosen. You may add multiple actions. The “Add Variable” let’s you choose a named property to use within the action. The properties listed are relevant to the event that is the bases of the trigger. The “Add Function” button let’s you choose a function that could be used to manipulate properties before being passed as parameters to actions.

Click on “OK” button to create the trigger.

Using Time Based Triggers

JSCAPE Secure FTP Server includes the “Current Time” event that you could listen to and could form the bases of a scheduler that allows you to execute actions on a recurring basis much like a cron job.

Summary

Triggers are perhaps JSCAPE MFT Server’s most powerful feature. It provides you the ability to augment and tailor the server’s functionality to meet your particular need. Please check the references below to see more details.

References

Trigger management
Event Types
Action Types
Function Types
Defining custom action types