tiCrypt 2.17.15

SFTP Inbox Configuration

ticrypt-sftp is configured through a single TOML file installed at /etc/ticrypt/ticrypt-sftp.toml. Restart the service after any change.

The service runs outside the secure perimeter with a one-way path to ticrypt-rest. See Components for where it sits in the architecture, and Inboxes for the user-facing workflow.

The installer writes this file

The Ansible installer writes deployment-specific values into ticrypt-sftp.toml, including the SFTP port and your backend domain. The defaults documented below are what the package ships, which is not necessarily what is running on your host.

Read your own file for the operative values, and expect a hand edit to be overwritten the next time the installer runs.

Deployment-specific settings

The installer sets these from your deployment configuration. Verify them rather than assuming, and set them by hand only on a deployment the installer does not manage.

Setting	Shipped default	What it should be
host_name	"localhost"	The hostname or IP senders put in their SFTP client. This value is handed to uploaders, so it must be reachable from outside
ticrypt_host	"gvb.terainsights.net"	Your tiCrypt backend domain

host_name = "sftp.yourinstitution.edu"
ticrypt_host = "ticrypt.yourinstitution.edu"

Never leave ticrypt_host at its default

The packaged default points at a Tera Insights host. On any deployment where the installer has not set it, this value must be corrected before the service is started.

Listeners

Setting	Value	What it does
listen_port	5820	TCP port for the management HTTP(S) API. Normally fronted by Nginx
[sftp] listen_port	2020	TCP port for SFTP over SSH. If the key is removed, the service falls back to 22
[sftp] key_file	/etc/ticrypt/sftp_rsa_key	RSA private key presented for SSH

SFTP ingress listens on 2020. That is the value in the shipped configuration file. Open that port on the SFTP host, as the Pre-Installation Checklist describes. The credentials page shows senders this same port and builds its sftp and scp commands from it, so if you change listen_port, the new value must be reachable from outside unchanged.

Storage and logging

Setting	Default	What it does
database_file	/var/lib/ticrypt-sftp/management.db	SQLite store for transfer records. Created if absent
log_file	unset	Log destination. Leave unset when running as a service, so output goes to the journal

As of 1.5.1 the local store uses write-ahead logging, which removes most of the per-file disk synchronization cost. Directory-heavy transfers of thousands of small files benefit most.

Upload pipeline (1.5.1)

Two settings in the [sftp] section tune how uploads are buffered. Both are commented out in the shipped file and take the defaults below. The defaults suit most deployments.

[sftp]
upload_queue_depth = 3    # full 8 MiB chunks that may wait to upload before writes block
upload_workers = 2        # chunks encrypted and uploaded concurrently

Memory per open file is bounded at roughly:

(8 SFTP workers + upload_queue_depth + upload_workers + 1) x 8 MiB

which is about 120 MiB with the defaults, regardless of file size or how fast the client sends. Raising either value trades memory for throughput on high-latency links to the backend.

Sessions and authentication

These govern tiCrypt user sessions on the inbox management API, not SFTP transfers themselves.

Setting	Default	What it does
[auth.sessions] initial_lifespan	30m	How long a new session stays valid after login, even when idle
[auth.sessions] extend_by	5m	Each authenticated request keeps the session valid at least this long from that moment, never past max_lifespan
[auth.sessions] max_lifespan	2h	Hard ceiling on session validity regardless of activity
[auth.challenges] token_size_bytes	32	Size of challenge tokens
[auth.challenges] lifespan	5m	How long an unanswered challenge remains valid

Fixed in 1.5.1

Before 1.5.1, extend_by and max_lifespan were parsed but never applied: every session expired a fixed 30 minutes after sign-in regardless of activity. Sessions now extend while in use and stop at max_lifespan, and contradictory lifetime settings are rejected at startup instead of being silently ignored. If you set these values previously and saw no effect, they take effect on upgrade.

Generated SFTP credentials

Setting	Default	What it does
[sftp] password_size_bytes	16	Size of the generated SFTP passwords. Do not set below 12
[sftp] user_lifespan	30m	How long a generated password stays valid. Opening the credentials link within this window returns the same password; after it, a new one is issued. The username is fixed per inbox

TLS

Optional, and normally unnecessary: the preferred deployment terminates TLS at Nginx. The service runs plain HTTP unless both a key and a certificate are given.

[tls]
key_file = "/etc/ticrypt-sftp/tls/key.pem"
cert_file = "/etc/ticrypt-sftp/tls/cert.pem"

See NGINX & TLS for the reverse-proxy setup.

Diagnostics (1.5.1)

pprof_listen exposes Go profiling endpoints for support investigations. It is disabled by default and should stay bound to loopback when enabled.

pprof_listen = "127.0.0.1:6060"

curl -s http://127.0.0.1:6060/debug/pprof/heap > heap.pb.gz

Upgrading

No configuration changes are required to move to 1.5.1. The new [sftp] upload settings and pprof_listen are optional and default to previous behavior.

1. Install the package: sudo dnf install ticrypt-sftp
2. Review /etc/ticrypt/ticrypt-sftp.toml.
3. Restart the service. A transfer in progress is given a grace period to finish.

The systemd unit allows time for a graceful stop and raises the file descriptor limit for deployments with many parallel connections.