FTP Input and SFTP Input

Host

URL for FTP. Protocol type or remote path should not be included as part of URL.

Port

Specify the port number used by the FTP server. Default value is 21.

Timeout

If the connection cannot be established before the timeout limit it will fail. Default timeout is 30 seconds.

Username and password

If user authentication is required, enter a username and password, otherwise anonymous logon will be used by default.

Remote path

The remote path on the FTP server where files need to be uploaded to (if different from the default log in directory of the FTP server). Click the Browse button to select, create or delete a folder on the remote host.

Filename/mask

Wildcards are supported for selecting one or more files to retrieve.

Transfer mode

Active mode, passive mode and extended passive mode are supported.

In active mode, the FTP client opens a dynamic port, sends the FTP server the dynamic port number on which it is listening over the control stream and waits for a connection from the FTP server. When the FTP server initiates the data connection to the FTP client, it binds the source port to port 20 on the FTP server.

In passive mode, the FTP server opens a dynamic port, sends the FTP client the server's IP address to connect to and the port on which it is listening over the control stream and waits for a connection from the FTP client. In this case, the FTP client binds the source port of the connection to a dynamic port.

In extended passive mode, the FTP server operates exactly the same as passive mode, however it only transmits the port number (not broken into high and low bytes) and the client is to assume that it connects to the same IP address that was originally connected to.

Secure Socket Layer

FTPS (SSL/TLS) is available in two incompatible modes. If using explicit FTPS, the client connects to the normal FTP port and explicitly switches into secure (SSL/TLS) mode with AUTH TLS, whereas Implicit SSL is an older style service that assumes SSL/TLS mode right from the start of the connection (and normally listens on TCP port 990, rather than 21).

If a verifiable server SSL certificate is required, it must be activated. Ensure that certificate is not expired, and the signature is valid.

Using Clear Control Channel enables the Firewall to open the correct ports.

Requirements

SubjectDN: Identifies the DN of the server’s certificate

SubjectCN: The certificate owner’s common name

IssuerDN: Identifies the CA that issued the certificate

IssuerCN: The certificate issuer’s common name

Best Practices / Ciphers

Click Best Practices to use the default cipher algorithm provided by the server.

Click Ciphers to select specific algorithms to allow. Select ciphers in the “available” list then click Allow to move them to the “allowed” list. Their order in the “allowed list” specifies their order of preference; use Move Up and Move Down to change algorithm order. Ciphers provide encryption, authentication, and data integrity checks in file transfer.

Note

If you click Ciphers but do not explicitly allow any, all available ciphers are allowed.

You can disallow connections with servers having keys smaller than 512 bits, 1024 bits or 2048 bits.

You can choose to Secure Renegotiation (as per RFC 5746).

FEAT

Select FEAT if you need to ask the server for additional commands that it supports outside the basic FTP protocol defined in RFC 959.

Note

Not all servers respond according to the RFC 959 standard.

Transfer mode

Not available for SFTP.

Fingerprint

Before establishing a connection, the SFTP server sends an encrypted fingerprint of its public host keys to ensure that the SFTP connection will be exchanging data with the correct server. Once you have established a connection to an SFTP server and are sure that it is the correct server, you should save the fingerprint information locally. This enables you to check the fingerprint information against the data you have saved every time you establish a new connection to ensure that no one is between you and the server.

Tip

To achieve a higher level of connection security protection, consider arranging to receive the SFTP server fingerprint before Lasernet connects to the server for the first time. Arrange to receive the fingerprint in two halves, with each half sent through a different communication channel (for example, first half sent through email, second half sent through a communication app). After reconstructing the fingerprint, you can check that fingerprint against the one that the SFTP server provides when Lasernet connects to it for the first time (and all subsequent times).

Security tab

Contains optional Private Key and accompanying Password setting.

Contains a Cipher list, which controls the cipher used for the connection. Ciphers provide encryption, authentication, and data integrity checks in file transfer. If no cipher is selected, a cipher is automatically negotiated when establishing the connection. If a cipher is selected but the other party to the connection does not support it, the connection will fail.

MatchedMask

The file mask matched.

Filepath

The URL for the file without the filename.

Filename

The name of the file without URL.

FullFilename

Name of the file including URL and filename.

Filesize

Size of the file.

Extension

Extension of the file.

FilenameWithoutExt

Name of the file without URL and without extension.