SFTP adapter security questions

[Former Member]

We have to establish a SFTP connection to an external partner because we have to pick up some files (SFTP sender adapter). Therefor we have to open port 22 for this connection. I've got two questions from our security guys.

1. Is it possible to attack the PI system though this connection?
2. Is it guaranteed that the SFTP sender channel closes the connection after each try respectively transfer?

For question 2 I have only found an implicit hint. SAP note 2069078 indicates that the adapter has exactly the required behavior.

[manoj_khavatkopp · Accepted solution]

Hi Gil,

For question 2:

You have option in Sftp adapter,  connection mode as per file transfer or permanent.

Regards,

Manoj

[Former Member · Accepted solution]

Maybe I haven't the newest version of the SFTP plugin. And I've found this online help.

https://help.sap.com/saphelp_nw-secure-connect102/helpdata/en/2e/99f0fb5a9e45b3b148c90e87fafcd1/cont...

[Former Member · Accepted solution]

Okay, my fault. It is implemented with SP04. We have to deploy it. Thank you.

[Former Member · Accepted solution]

Manoj Kh wrote:

Hi Gil,
For question 2:
You have option in Sftp adapter,  connection mode as per file transfer or permanent.

Regards,
Manoj

I have to reactivate this topic again. In the meantime we installed the SP04 and I imported the corresponding ESR content but I can find a possibility to activate the permanent activation mode. Can anybody help here?

Here is the documentation for SP04: http://help.sap.com/nw-secure-connect104

Release notes: "Permanent connection mode is supported for SFTP receiver channels."

But I can't find the corresponding parameter in the configuration guide. http://help.sap.com/saphelp_nw-secure-connect104/helpdata/en/cd/7c47aa02074adbbc7ba541b446c026/frame...

And the next problem is that this feature is only for the receiver. I need a statement for the sender.

[Former Member · Accepted solution]

Okay, it seems that the way described in 2069078 is the only way. (What a crap. )

[manoj_khavatkopp · Accepted solution]

Gil , i am not sure on SAP SFTP adapter but the connection mode is available in Advantco SFTP adapter (Sender and Receiver) i guess you need to go with advanced parameter only as mentioned in note 2069078.

[former_member183816]

For your first question,

Yes it is secured. It also uses SSL/TLS just like your HTTPS connection does. On top of it, you are polling FTP server (not like FTP server is pushing files on your PI server), so until unless your FTP server is compromised, no one can enter in your PI system.

Read page no 10 here,

https://www.sans.org/reading-room/whitepapers/casestudies/case-study-secure-file-transfer-implementi...

[vicky20691]

Hi Gil,

1. SFTP is more secure than FTP obviously. If you want your files to be secured and prevent from attack do go for PGP encryption. It comes with SFTP add-on itself

2. You have already figured out answer to ques 2 as i can see above

regards,

Vikas