> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arc.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SFTP Server Connector

> Configuration and usage guide for the CData Arc SFTP Server connector, which defines client profiles for authenticating to the built-in SFTP server.

export const TrustedIp = () => <>
    <p>The following functions are available in the <strong>Trusted IP Addresses</strong> section:</p>

    <table>
      <thead>
        <tr><th>Function</th><th>Description</th></tr>
      </thead>
      <tbody>
        <tr><td><strong>Add</strong></td><td>Enter a new IP address range.</td></tr>
        <tr><td><strong>Edit</strong></td><td>Modify the selected IP address range.</td></tr>
        <tr><td><strong>Delete</strong></td><td>Deletes the selected IP address range from the list.</td></tr>
      </tbody>
    </table>

    <p>The following restrictions apply to this feature:</p>

    <ul style={{
  listStyleType: 'disc',
  paddingLeft: '1.5rem'
}}>
      <li style={{
  display: 'list-item'
}}><code>localhost</code> cannot be modified or removed from the list.</li>
      <li style={{
  display: 'list-item'
}}>Any IP addresses outside of the defined ranges are rejected.</li>
      <li style={{
  display: 'list-item'
}}>Ranges are supported. For example, the entry <code>100.10.100.1-15</code> indicates that IP addresses between <code>100.10.100.1</code> and <code>100.10.100.15</code> are allowed.</li>
      <li style={{
  display: 'list-item'
}}>Classless inter-domain routing (CIDR) notation is supported. For example, the entry <code>100.10.100.0/24</code> indicates that IP addresses between <code>100.10.100.0</code> and <code>100.10.100.255</code> are allowed.</li>
      <li style={{
  display: 'list-item'
}}>Wildcard patterns are supported. For example, the entry <code>100.10.100.*</code> indicates that IP addresses beginning with <code>100.10.100</code> are allowed.</li>
    </ul>

    <Note>
      <p>In order for clients to reach the server, a clear network path is required. In cloud environments you might need to make changes in three places:</p>
      <p style={{
  paddingLeft: '1.5rem',
  marginTop: '0.25rem',
  marginBottom: '0.25rem'
}}>• The networking rules in the cloud console.</p>
      <p style={{
  paddingLeft: '1.5rem',
  marginTop: '0.25rem',
  marginBottom: '0.25rem'
}}>• The firewall rules on the machine hosting the application. For example, when using an Amazon AMI, you might use an <em>Uncomplicated Firewall</em> (UFW) to allow traffic on the desired port. A common strategy in Linux environments is to forward traffic from ports lower than 1024 to a non-standard port higher than 1024, while configuring the application to use the non-standard port. This avoids permission issues associated with non-root users binding to ports lower than 1024.</p>
      <p style={{
  paddingLeft: '1.5rem',
  marginTop: '0.25rem',
  marginBottom: '0.25rem'
}}>• The <a href="/26.3/cloud/en/getting-started/administration/settings/network-access">Network Access</a> portion of the <a href="/26.3/cloud/en/getting-started/administration/settings/security">Security</a> tab.</p>
    </Note>
  </>;

export const ServerStatus = () => <>
    <p><em>The current state of the connector's underlying service. The following statuses are available:</em></p>
    <table>
      <thead>
        <tr>
          <th>Status</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td><strong>Active</strong></td>
          <td>The service is running.</td>
        </tr>
        <tr>
          <td><strong>Inactive</strong></td>
          <td>The service is configured but is not currently running.</td>
        </tr>
        <tr>
          <td><strong>Not Configured</strong></td>
          <td>The underlying profile or service has not been set up.</td>
        </tr>
      </tbody>
    </table>
  </>;

export const NameDescription = ({extraRows}) => <table>
    <thead>
      <tr>
        <th>Setting</th>
        <th>Description</th>
      </tr>
    </thead>
    <tbody>
      <tr>
        <td><strong>Connector Id</strong></td>
        <td>The static, unique identifier for the connector.</td>
      </tr>
      <tr>
        <td><strong>Connector Type</strong></td>
        <td>Displays the connector name and a description of what it does.</td>
      </tr>
      <tr>
        <td><strong>Connector Description</strong></td>
        <td>An optional field to provide a free-form description of the connector and its role in the flow.</td>
      </tr>
      {extraRows}
    </tbody>
  </table>;

export const SlasTab = ({siteName = "CData Arc"}) => <>
    <p><em>Settings related to configuring Service Level Agreements (SLAs).</em></p>
    <p>
      SLAs enable you to configure the volume you expect connectors in your flow to send or receive, and to set the time frame in which you expect that volume to be met. {siteName} sends emails to warn the user when an SLA is not met, and marks the SLA as <em>At Risk</em>, which means that if the SLA is not met soon, it will be marked as <em>Violated</em>. This gives the user an opportunity to step in and determine the reasons the SLA is not being met, and to take appropriate actions. If the SLA is still not met at the end of the at-risk time period, the SLA is marked as violated, and the user is notified again.
    </p>
    <p>
      To define an SLA, toggle <strong>Expected Volume</strong> on, then click the <strong>Settings</strong> tab.
    </p>
    <img src="/public/images/sla_empty.png" alt="SLA Empty" />
    <ul>
      <li>If your connector has separate send and receive actions, use the radio buttons to specify which direction the SLA pertains to.</li>
      <li>In the <strong>Expect at least</strong> portion of the window:
        <ul>
          <li>Set the minimum number of transactions you expect to be processed (the volume)</li>
          <li>Use the <strong>Every</strong> fields to specify the time frame</li>
          <li>Indicate when the SLA should go into effect. If you choose <strong>Starting on</strong>, complete the date and time fields.</li>
          <li>Check the boxes for the days of the week that you want the SLA to be in effect. Use the dropdown to choose <strong>Everyday</strong> if necessary.</li>
        </ul>
      </li>
      <li>In the <strong>Set status to 'At Risk'</strong> portion of the window, specify when the SLA should be marked as at risk.
        <ul>
          <li>By default, notifications are not sent until an SLA is in violation. To change that, check <strong>Send an 'At Risk' notification</strong>.</li>
        </ul>
      </li>
    </ul>
    <p>
      The following example shows an SLA configured for a connector that expects to receive 1000 files every day Monday-Friday. An at-risk notification is sent 1 hour before the end of the time period if the 1000 files have not been received.
    </p>
    <img src="/public/images/sla_defined.png" alt="SLA Configuration Example" />
    <Note>
      You can turn off SLA alerts if necessary. This can be useful during maintenance windows. Click <strong>Settings</strong> on the navbar, then navigate to <strong>Alerts &gt; General Alerts</strong>. Click the tablet and pencil icon to edit, and uncheck the <strong>SLA Alerts</strong> setting.
    </Note>
  </>;

export const AlertsTab = ({siteNameShort = "Arc"}) => <>
    <p><em>Settings related to configuring alerts.</em></p>
    <p>
      Before you can execute Service Level Agreements (SLAs), you need to set up email alerts for notifications. By default, {siteNameShort} uses the global settings on the <a href="/26.3/cloud/en/getting-started/administration/settings/alerts">Alerts</a> tab. To use other settings for this connector, toggle <strong>Override global setting</strong> on.
    </p>
    <p>
      By default, error alerts are enabled, which means that emails are sent whenever there is an error. To turn them off, uncheck the <strong>Enable</strong> checkbox.
    </p>
    <p>
      Enter a <strong>Subject</strong> (mandatory). Check <strong>Allow {siteNameShort}Script in Subject</strong> to use {siteNameShort}Script in the <strong>Subject</strong> field. When you select this, the <strong>{siteNameShort}Script Editor</strong> button appears (<img src="/public/images/rest_arcscript_editor.png" alt="arcscript editor button" style={{
  display: 'inline',
  verticalAlign: 'middle',
  margin: 0
}} />).
    </p>
    <p>
      Optionally, enter a comma-separated list of <strong>Recipient</strong> emails.
    </p>
  </>;

export const MiscConnector = () => <>
    <p><em>Miscellaneous settings are for specific use cases.</em></p>
    <table>
      <thead>
        <tr>
          <th>Setting</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td><strong>Other Settings</strong></td>
          <td>Enables you to configure hidden connector settings in a semicolon-separated list (for example, <code>setting1=value1;setting2=value2</code>). Normal connector use cases and functionality should not require the use of these settings.</td>
        </tr>
      </tbody>
    </table>
  </>;

export const Logging = () => <>
    <p><em>Settings that govern the creation and storage of logs.</em></p>
    <table>
      <thead>
        <tr>
          <th>Setting</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td><strong>Log Level</strong></td>
          <td>The verbosity of logs generated by the connector. When you request support, set this to <strong>Debug</strong>.</td>
        </tr>
        <tr>
          <td><strong>Log Subfolder Scheme</strong></td>
          <td>Instructs the connector to group files in the Logs folder according to the selected interval. The <strong>Weekly</strong> option (which is the default) instructs the connector to create a new subfolder each week and store all logs for the week in that folder. Leaving this setting blank tells the connector to save all logs directly in the Logs folder. For connectors that process many transactions, using subfolders helps keep logs organized and improves performance.</td>
        </tr>
        <tr>
          <td><strong>Log Messages</strong></td>
          <td>Check this to have the log entry for a processed file include a copy of the file itself. If you disable this, you might not be able to download a copy of the file from the <strong>Transactions</strong> tab.</td>
        </tr>
      </tbody>
    </table>
  </>;

export const ProfileLogging = () => <>
    <p><em>Settings that govern the creation and storage of logs.</em></p>
    <table>
      <thead>
        <tr>
          <th>Setting</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody>
        <tr>
          <td><strong>Log Level</strong></td>
          <td>The verbosity of logs generated by the connector. When you request support, set this to <strong>Debug</strong>.</td>
        </tr>
        <tr>
          <td><strong>Log Rotate Interval</strong></td>
          <td>The number of days to wait before creating a new log file.</td>
        </tr>
        <tr>
          <td><strong>Log Delete Interval</strong></td>
          <td>The number of days to wait before deleting old log files.</td>
        </tr>
      </tbody>
    </table>
  </>;

export const MacrosExamples = ({extraMacros = []}) => <>
    <p>
      Some macros, such as %Ext% and %ShortDate%, do not require an argument, but others do. All
      macros that take an argument use the following syntax: <code>%Macro:argument%</code>
    </p>

    <p>Here are some examples of the macros that take an argument:</p>

    <ul>
      <li>%Header:headername%: Where <code>headername</code> is the name of a header on a message.</li>
      <li>%Header:mycustomheader% resolves to the value of the <code>mycustomheader</code> header set on the input message.</li>
      <li>%Header:ponum% resolves to the value of the <code>ponum</code> header set on the input message.</li>
      <li>%RegexFilename:pattern%: Where <code>pattern</code> is a regex pattern. For example, <code>%RegexFilename:^([\w][A-Za-z]+)%</code> matches and resolves to the first word in the filename and is case insensitive (<code>test_file.xml</code> resolves to <code>test</code>).</li>
      <li>%Vault:vaultitem%: Where <code>vaultitem</code> is the name of an item in the <a href="/26.3/cloud/en/getting-started/administration/settings/global-settings-vault">vault</a>. For example, <code>%Vault:companyname%</code> resolves to the value of the <code>companyname</code> item stored in the vault.</li>
      <li>%DateFormat:format%: Where <code>format</code> is an accepted date format (see <a href="/26.3/cloud/en/scripting/value-formatters/date-formatters#sample-date-formats">Sample Date Formats</a> for details). For example, <code>%DateFormat:yyyy-MM-dd-HH-mm-ss-fff%</code> resolves to the date and timestamp on the file.</li>
      {extraMacros.filter(item => item.example).map(item => <li key={`ex-${item.name}`}>{item.example}</li>)}
    </ul>

    <p>You can also create more sophisticated macros, as shown in the following examples:</p>

    <ul>
      <li>Combining multiple macros in one filename: <code>%DateFormat:yyyy-MM-dd-HH-mm-ss-fff%%EXT%</code></li>
      <li>Including text outside of the macro: <code>MyFile_%DateFormat:yyyy-MM-dd-HH-mm-ss-fff%</code></li>
      <li>Including text within the macro: <code>%DateFormat:'DateProcessed-'yyyy-MM-dd_'TimeProcessed-'HH-mm-ss%</code></li>
    </ul>
  </>;

export const MacrosTable = ({siteName = "CData Arc", extraMacros = []}) => <>
    <p>
      Using macros in file naming strategies can enhance organizational efficiency and contextual
      understanding of data. By incorporating macros into filenames, you can dynamically include
      relevant information such as identifiers, timestamps, and header information, providing
      valuable context to each file.
    </p>

    <p>{siteName} supports these macros, which all use the following syntax: <code>%Macro%</code>.</p>

    <table>
      <thead>
        <tr><th>Macro</th><th>Description</th></tr>
      </thead>
      <tbody>
        <tr><td>ConnectorID</td><td>Evaluates to the ConnectorID of the connector.</td></tr>
        <tr><td>ConnectorName</td><td>Evaluates to the name of the connector. Enables you to include the connection name in file names or paths: for example, to tag backup files by which database connection produced them.</td></tr>
        <tr><td>Ext</td><td>Evaluates to the file extension of the file currently being processed by the connector.</td></tr>
        <tr><td>Filename</td><td>Evaluates to the filename (extension included) of the file currently being processed by the connector.</td></tr>
        <tr><td>FilenameNoExt</td><td>Evaluates to the filename (without the extension) of the file currently being processed by the connector.</td></tr>
        <tr><td>MessageId</td><td>Evaluates to the MessageId of the message being output by the connector.</td></tr>
        <tr><td>RegexFilename:<em>pattern</em></td><td>Applies a RegEx pattern to the filename of the file currently being processed by the connector.</td></tr>
        <tr><td>Header:<em>headername</em></td><td>Evaluates to the value of a targeted header (<code>headername</code>) on the current message being processed by the connector.</td></tr>
        <tr><td>LongDate</td><td>Evaluates to the current datetime of the system in long-handed format (for example, Wednesday, January 24, 2024).</td></tr>
        <tr><td>ShortDate</td><td>Evaluates to the current datetime of the system in a yyyy-MM-dd format (for example, 2024-01-24).</td></tr>
        <tr><td>DateFormat:<em>format</em></td><td>Evaluates to the current datetime of the system in the specified format (<code>format</code>). See <a href="/26.3/cloud/en/scripting/value-formatters/date-formatters#date-formats-with-literal-characters">Sample Date Formats</a> for the available datetime formats.</td></tr>
        <tr><td>Vault:<em>vaultitem</em></td><td>Evaluates to the value of the specified vault item.</td></tr>
        {extraMacros.map(item => <tr key={item.name}>
            <td>{item.name}</td>
            <td>{item.description}</td>
          </tr>)}
      </tbody>
    </table>
  </>;

export const companyName = "CData";

export const siteNameShort = "Arc";

export const siteName = "CData Arc";

Each SFTP Server connector defines a unique client profile that can be used to authenticate to the {siteNameShort} SFTP Server.

## Key Capabilities

* Embedded SSH-based secure file server with multi-user support
* Flexible authentication including password, public key, and Windows/AD integration (Windows/AD integration is only available in the .NET edition)
* Individual user directories with customizable folder structures and additional paths
* Advanced security features including login attempt lockouts and IP restrictions
* Support for temporary file extensions and automatic file movement after operations

## Overview

The {siteNameShort} SFTP Server connector is primarily configured on the [Profiles](../getting-started/administration/profiles) page. Then, individual SFTP Server connectors can be created for each trading partner who should have access to the server. The SFTP Server connector defines a trading partner's credentials (username, password and/or public key) and provides a unique home directory on the server.

Each user's home directory contains a *Send* folder, where clients can download files, and a *Receive* folder, where clients can upload files. You can rename these folders on the [Advanced tab](#advanced-tab). SFTP clients are not given permissions to the root of the SFTP server, which means that SFTP clients should always *cd* into the Send or Receive directories after connecting.

The SFTP Server also supports Windows/AD authentication. See [Windows Authentication](#windows-authentication) for details.

### Video Resources

Watch this short video for an overview of how to configure an SFTP Server.

<iframe width="560" height="315" src="https://www.youtube.com/embed/R1OrVVdqySU" frameBorder="0" allowFullScreen />

## Profile Configuration

The SFTP Server profile must be configured before connections can be established with individual SFTP Server connectors. Click **Profiles** on the navbar, then click the **SFTP Server** tab.

### Server Configuration

*Server implementation settings.*

| Setting                    | Description                                                                                                                                                                                                                                                                                                         |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Port**                   | The port on which the SFTP server listens for incoming connections.                                                                                                                                                                                                                                                 |
| **Server Certificate**     | The certificate that identifies the server.                                                                                                                                                                                                                                                                         |
| **Certificate Password**   | The password required to access the server certificate.                                                                                                                                                                                                                                                             |
| **Login Banner**           | The banner presented to SFTP clients when they connect to the server.                                                                                                                                                                                                                                               |
| **Root Directory**         | The root directory for the server. Subfolders are created in the root for individual client profiles (for each configured SFTP Server connector). Each client profile includes a Send folder, where clients can download files from the server, and a Receive folder, where clients can upload files to the server. |
| **Allowed Files Filter**   | A glob pattern that determines which files are accepted by the SFTP server. You can use negative patterns to indicate files that should *not* be downloaded (for example, -\*.tmp). Separate multiple file types by commas (for example, \*.x12,\*.edi).                                                            |
| **Windows Authentication** | Check this to use Windows Authentication to authenticate users instead of the SFTP Server connector configurations. Only available in the [.NET edition](../getting-started/installation/windows-edition) of {siteNameShort}. See [Windows Authentication](#windows-authentication) for more information.           |
| **Security Group**         | The name of the Windows group used for granting access to the server. This can be a group on the local machine or on the domain. Only applicable when **Use Windows Authentication** is checked.                                                                                                                    |

#### Lockouts

*Optional settings related to locking server access.*

| Setting               | Description                                                                      |
| --------------------- | -------------------------------------------------------------------------------- |
| **Failed Attempts**   | The number of unsuccessful login attempts allowed before the user is locked out. |
| **Lockout Period**    | The length of time (in minutes) that the user is locked out.                     |
| **Time Check Period** | The length of time (in minutes) that records are kept of failed login attempts.  |

#### Trusted IP Addresses

<TrustedIp />

### Advanced Settings

| Setting                | Description                                                                             |
| ---------------------- | --------------------------------------------------------------------------------------- |
| **Inactivity Timeout** | The length of time (in seconds) that must pass without activity for a user to time out. |

#### Logging

<ProfileLogging />

#### Miscellaneous

<MiscConnector />

## Connector Configuration

Once you configure the SFTP Server profile settings, create and configure an individual SFTP Server connector for each trading partner on the Flows page.

### Settings Tab

#### Configuration

<NameDescription />

#### Server Status

<ServerStatus />

Click the **View SFTP Server Profile** link to open the profile in a new tab.

#### User Configuration

*Credentials for authenticating to the local SFTP server.*

| Setting                 | Description                                                                                                                        |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| **User**                | The username credential for logging in to the local SFTP server.                                                                   |
| **Authentication Mode** | The type of authentication to use with the SFTP server. The following fields vary based on your authentication mode.               |
| **Password**            | The password credential for logging in to the SFTP server.                                                                         |
| **Client Certificate**  | The public key certificate corresponding to the private certificate the client uses when you choose **Public Key** authentication. |

#### Permissions

*Settings related to the read/write permissions for the Send and Receive folders.*

| Setting                           | Description                                                                                                     |
| --------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| **Send Directory Permissions**    | Use the checkboxes to set read/write permissions for the *Send* directory. This is where files are downloaded.  |
| **Receive Directory Permissions** | Use the checkboxes to set read/write permissions for the *Receive* directory. This is where files are uploaded. |

### Advanced Tab

#### Local Folders

*Settings related to the folders where clients upload and download files. Rename the default folders here.*

| Setting                     | Description                                                                                                                                                    |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Input Folder (Send)**     | Files placed in the Send folder are available to be downloaded by clients.                                                                                     |
| **Output Folder (Receive)** | Files uploaded by the client should be placed in the Receive folder. Files remain in the Receive folder or are passed along to the next connector in the flow. |

#### Additional Paths

The SFTP Server connector allows you to expose paths in addition to the Input and Output folders. To configure additional paths, follow these steps:

1. Use the **Path** field to specify the additional path that should be exposed. Path values are relative to the **Root Directory** defined on the Profiles page.
2. Set the permissions for the additional path using the **Read** and **Write** checkboxes.
3. If more paths are needed, click **New** and repeat these steps for each path.

For example, if **Root Directory** is set to `/var/opt/arc/sftpserver`, and an additional path of `MyAdditionalPath` is added, it maps to the `/var/opt/arc/sftpserver/MyAdditionalPath` path on disk.

#### Advanced Settings

*Settings not included in the previous categories.*

| Setting                     | Description                                                                                                                                                                                                                                                                                                                                                      |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Home Directory**          | The configured server path where connected users start after logging in. Use the connector home, the Send or Receive folder, or a defined [additional path](#additional-paths). For the valid locations and how the path is validated, see [Home Directory](#home-directory).                                                                                    |
| **Allowed Files Filter**    | A glob pattern that determines which files are accepted by the SFTP server. You can use negative patterns to indicate files that should *not* be downloaded (for example, -\*.tmp). Separate multiple file types by commas (for example, \*.x12,\*.edi). Overrides the **Allowed Files Filter** option on the Server Configuration portion of the Profiles page. |
| **Move File After Send**    | Specifies whether files in the *Send* folder should be moved to the *Sent* folder after they are downloaded by the client.                                                                                                                                                                                                                                       |
| **Temp Receive Extensions** | Files with a matching extension are not recorded in the Receive table and do not fire the **After Receive** event until after they are renamed. Supply a comma-delimited list of extensions.                                                                                                                                                                     |
| **Timeout**                 | The length of time (in seconds) the server waits for a connection response before throwing a timeout error.                                                                                                                                                                                                                                                      |
| **Save Subfolder**          | Check this to have a *Subfolder* header added to received messages. It represents the path relative to the local folders or additional paths.                                                                                                                                                                                                                    |
| **Finalize on Disconnect**  | Check this to delay file finalization until the client disconnects. This allows clients to perform additional operations (such as renaming) on uploaded files without errors caused by the file being moved prematurely.                                                                                                                                         |
| **Local File Scheme**       | A scheme for assigning filenames to messages that are output by the connector. You can use macros in your filenames dynamically to include information such as identifiers and timestamps. For more information, see [Macros](#macros).                                                                                                                          |

#### Logging

<Logging />

#### Miscellaneous

<MiscConnector />

### Alerts Tab

<AlertsTab />

### SLAs Tab

<SlasTab />

## Establishing a Connection

Each SFTP Server connector represents a single trading partner's connection parameters. The trading partner should connect to the SFTP server using the server settings from the [Profiles](../getting-started/administration/profiles) page (port, server certificate, and so on) and the authentication settings in the dedicated SFTP Server connector (user and password).

Each trading partner has a pair of *Send* and *Receive* directories that are subfolders of the root. The partner downloads files from the Send folder and uploads files to the Receive folder. The client is not permitted to upload or download files from the root.

## Home Directory

The **Home Directory** setting controls which folder a client lands in when it logs in to an SFTP Server connector. Configure it on the connector's **Advanced** tab, under **Advanced Settings**. Setting a home directory is useful when you migrate from other SFTP or FTP software that lets you configure a landing folder, or for automated systems that upload or download at whatever directory they land in without issuing navigation (`cd`) commands.

The field defaults to empty, but it also accepts a server path:

* **Empty (default):** The client lands at the connector home (`/<connectorId>`).
* **Set to a path:** On successful login, the client's initial working directory is the specified path. A client that connects and immediately uploads, downloads, or lists files without changing directories operates inside the home directory.

The home directory must be a server path (starting with `/`) that resolves against the **Root Directory** defined on the connector's [Profile](#profile-configuration), and it must match a configured server location; you cannot set it to an arbitrary path that only exists on disk. For the SFTP Server connector, the valid locations are:

* `/<connectorId>` (the connector home): this is the default when the field is empty
* `/<connectorId>/Send`
* `/<connectorId>/Receive`
* Any defined [additional path](#additional-paths) (for example, `/Staging`)

The server root (`/`) is not a valid home directory on the SFTP Server connector; it returns a permission error, because there is no readable mount at the root.

The field normalizes your input, so `Receive`, `/Receive`, `\Receive`, and `/Receive/` are all treated as the same path. The value is validated when you save the connector: a path that does not match a configured server location is rejected with an error that names the invalid value. If you set an additional path as the home directory and that path is later removed from the configuration, saving the connector rejects the now-stale value.

<Note>The home directory only sets the initial landing directory at login. It is not a chroot or jail and does not restrict which folders a client can navigate to afterward; folder access is still governed by the [permission settings](#permissions).</Note>

### Home Directory and the SFTP Client Remote Path

When an [SFTP](./sftp) client connector connects to an SFTP Server connector that has a home directory configured, the SFTP client's **Remote Path** setting still applies independently. The following table shows the resulting working directory for each combination:

| SFTP Server Home Directory | SFTP Client Remote Path | Resulting working directory |
| -------------------------- | ----------------------- | --------------------------- |
| *(empty)*                  | *(empty)*               | `/<connectorId>`            |
| *(empty)*                  | `/`                     | Permission error            |
| *(empty)*                  | `Receive`               | `/<connectorId>/Receive`    |
| `/Test`                    | *(empty)*               | `/Test`                     |
| `/Test`                    | `/`                     | Permission error            |
| `/Test`                    | `/<connectorId>`        | `/<connectorId>`            |

## Windows Authentication

When Windows Authentication is enabled on the [Server Configuration](./sftp-server#server-configuration) portion of the Profiles tab, individual SFTP Server connectors are not required to grant login access to the SFTP Server. Instead, you need to specify the name of the Windows **Security Group** that should be granted access to the server.

When Windows Authentication is enabled, the **Root Directory** profile setting supports the %User% and %Domain% macros to establish separate root directories for separate users in the security group. Therefore, when Windows Authentication is enabled, users *are* permitted to upload/download files in the root directory (this is not true when you use SFTP Server connectors for authentication).

Once files are uploaded to the user-specific folder, they can be entered into the {siteNameShort} flow using a [File connector](./file).

## Macros

<MacrosTable />

### Examples

<MacrosExamples />

## Common Errors

### Error: Could not bind server socket: Permission denied.

**Cause**

This error can appear when attempting to connect to an SFTP server and the process hosting {siteNameShort} does not have sufficient privileges to establish a listener on the specified port. Note that in some cases (such as Linux environments and hosted instances running in an Amazon AMI), ports below 1024 are forbidden from access.

**Resolution**

Choose a different port, or change the identity of the process hosting {siteNameShort} to one with permissions to bind to the port.

The Amazon AMI-hosted version of {siteNameShort} uses the Ubuntu operating system, so {companyName} recommends that you use an *Uncomplicated Firewall* (UFW) to manage port permission issues. For example, setting up SFTP Server to run on port 8022 in {siteNameShort} and using UFW to forward port 22 to 8022 at the OS level looks like this:

```
ufw allow 22/tcp
ufw allow 8022/tcp
echo "
*nat
:PREROUTING ACCEPT [0:0]
-A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 8022
COMMIT" >> /etc/ufw/before.rules
```

If your environment uses a different Linux operating system, {companyName} recommends that you bind to a port above the restricted range (for example, 8022 for SFTP traffic) and use `iptables` to route incoming requests on the desired port to the allowed port:

`iptables -t nat -I PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 8022`