SFTP Configuration
ticrypt-sftp is configured through a single
TOML file installed at /etc/ticrypt/ticrypt-sftp.toml. Restart the service after any change.
The service runs outside the secure perimeter with a one-way path to ticrypt-rest. See
Components for where it sits in the
architecture, and Inboxes for the user-facing workflow.
The Ansible installer writes
deployment-specific values into ticrypt-sftp.toml, including the SFTP port and your backend
domain. The defaults documented below are what the package ships, which is not necessarily what
is running on your host.
Read your own file for the operative values, and expect a hand edit to be overwritten the next time the installer runs.
Deployment-specific settings
The installer sets these from your deployment configuration. Verify them rather than assuming, and set them by hand only on a deployment the installer does not manage.
| Setting | Shipped default | What it should be |
|---|---|---|
host_name | "localhost" | The hostname or IP senders put in their SFTP client. This value is handed to uploaders, so it must be reachable from outside |
ticrypt_host | "gvb.terainsights.net" | Your tiCrypt backend domain |
host_name = "sftp.yourinstitution.edu"
ticrypt_host = "ticrypt.yourinstitution.edu"
ticrypt_host at its defaultThe packaged default points at a Tera Insights host. On any deployment where the installer has not set it, this value must be corrected before the service is started.
Listeners
| Setting | Value | What it does |
|---|---|---|
listen_port | 5820 | TCP port for the management HTTP(S) API. Normally fronted by Nginx |
[sftp] listen_port | 2022 (package default 2020) | TCP port for SFTP over SSH |
[sftp] key_file | /etc/ticrypt/sftp_rsa_key | RSA private key presented for SSH |
SFTP ingress listens on 2022. The installer sets that value; 2020 is the default compiled into
the shipped configuration file and is overridden at deployment. Open 2022 on the SFTP host, as
the Pre-Installation Checklist
describes.
Storage and logging
| Setting | Default | What it does |
|---|---|---|
database_file | /var/lib/ticrypt-sftp/management.db | SQLite store for transfer records. Created if absent |
log_file | unset | Log destination. Leave unset when running as a service, so output goes to the journal |
As of 1.5.1 the local store uses write-ahead logging, which removes most of the per-file disk synchronization cost. Directory-heavy transfers of thousands of small files benefit most.
Upload pipeline (1.5.1)
Two settings in the [sftp] section tune how uploads are buffered. Both are commented out in the
shipped file and take the defaults below. The defaults suit most deployments.
[sftp]
upload_queue_depth = 3 # full 8 MiB chunks that may wait to upload before writes block
upload_workers = 2 # chunks encrypted and uploaded concurrently
Memory per open file is bounded at roughly:
(8 SFTP workers + upload_queue_depth + upload_workers + 1) x 8 MiB
which is about 120 MiB with the defaults, regardless of file size or how fast the client sends. Raising either value trades memory for throughput on high-latency links to the backend.
Sessions and authentication
These govern tiCrypt user sessions on the inbox management API, not SFTP transfers themselves.
| Setting | Default | What it does |
|---|---|---|
[auth.sessions] initial_lifespan | 30m | How long a new session stays valid after login, even when idle |
[auth.sessions] extend_by | 5m | Each authenticated request keeps the session valid at least this long from that moment, never past max_lifespan |
[auth.sessions] max_lifespan | 2h | Hard ceiling on session validity regardless of activity |
[auth.challenges] token_size_bytes | 32 | Size of challenge tokens |
[auth.challenges] lifespan | 5m | How long an unanswered challenge remains valid |
Before 1.5.1, extend_by and max_lifespan were parsed but never applied: every session expired a
fixed 30 minutes after sign-in regardless of activity. Sessions now extend while in use and stop at
max_lifespan, and contradictory lifetime settings are rejected at startup instead of being
silently ignored. If you set these values previously and saw no effect, they take effect on upgrade.
Generated SFTP credentials
| Setting | Default | What it does |
|---|---|---|
[sftp] password_size_bytes | 16 | Size of generated one-time passwords. Do not set below 12 |
[sftp] user_lifespan | 30m | How long a generated SFTP user remains valid |
TLS
Optional, and normally unnecessary: the preferred deployment terminates TLS at Nginx. The service runs plain HTTP unless both a key and a certificate are given.
[tls]
key_file = "/etc/ticrypt-sftp/tls/key.pem"
cert_file = "/etc/ticrypt-sftp/tls/cert.pem"
See NGINX & TLS for the reverse-proxy setup.
Diagnostics (1.5.1)
pprof_listen exposes Go profiling endpoints for support investigations. It is disabled by
default and should stay bound to loopback when enabled.
pprof_listen = "127.0.0.1:6060"
curl -s http://127.0.0.1:6060/debug/pprof/heap > heap.pb.gz
Upgrading
No configuration changes are required to move to 1.5.1. The new [sftp] upload settings and
pprof_listen are optional and default to previous behavior.
- Install the package:
sudo dnf install ticrypt-sftp - Review
/etc/ticrypt/ticrypt-sftp.toml. - Restart the service. A transfer in progress is given a grace period to finish.
The systemd unit allows time for a graceful stop and raises the file descriptor limit for deployments with many parallel connections.