SAP XI support SFTP and FTPS?

[Former Member]

Hi Gurus,

I would like to find out if SAP XI supports both SFTP and FTPS. If yes, how do I perform the configuration?

Thanks in advance.

[Former Member · Accepted solution]

Hi

Please do find the link related to SFTP and FTPS with XI/PI.

Thanks

Sudharshan

[Former Member]

Thank you everyone for all the helpful replies. Points have been awarded to all.

[Former Member]

Hi,

SAP XI/PI supports FTPS i.e. FTP using SSL/TLS. To configure it, select the appropriate option under Connection Security in FTP Connection Parameters in the FTP File Adapter. For details see FTP Connection Parameters --> Connection Security section at [this link|http://help.sap.com/saphelp_nw2004s/helpdata/en/e3/94007075cae04f930cc4c034e411e1/frameset.htm].

For SFTP, a third party SFTP adapter needs to be used. Seeburger AG provides such an SFTP adapter for SAP XI.

Hope this helps.

Regards,

Riyaz

Edited by: Riyaz Sayyad on Jul 8, 2008 4:27 PM

[Former Member]

Business Case:

In many implementations Business requirement is to "secure" the file/data transfer between XI and any third-party system. So there is a need of secured connection between XI/PI and any file based third-party legacy systems.

Following solutions are proposed to cater secure connection between XI/PI and any third party systems.

1) SFTP (Secure File Transfer Protocol)

"SSH File Transfer Protocol" or SFTP is a network protocol that provides file transfer and manipulation functionality over any reliable data stream. It is typically used with the SSH-2 protocol to provide secure file transfer. SFTP encrypts the session, preventing the casual detection of username, password or anything that is being transmitted. One key benefit to SFTP is its ability to handle multiple secure file transfers over a single encrypted pipe. By using a single encrypted pipe, there are fewer holes in the corporate firewall.

2) FTPS (FTP over SSL)

FTPS (FTP-SSL) is a real ftp that uses TSL/SSL to encrypt the control session and if required the data session. With FTPS, the control session is always encrypted, but the data session may not be always encrypted. FTPS is a file transport layer on top of SSL. SSL, or Secure Sockets Layer, is a method by which an encrypted u2018pipe' or tunnel is established between the FTP client and FTP server. Once the secure tunnel has been established (which is done using 128-bit encryption techniques), standard FTP is used to transfer data over the secure connection.

Feasibility of SFTP and FTPS in XI:

SFTP:

As per the latest SAP PI/XI support pack, it does not support SFTP via File Adapter.

So alternative approach to cater this requirement from XI is to make use of Unix Script at OS level to transfer the files from/to third-party systems.

• Inbound Interface - i.e. third-party system ->XI->SAP:

File is transferred to a folder in SAP XI landscape from the third-party legacy system using UNIX Script with secured protocol. Once the file is ready in the XI landscape, File Adapter will poll this directory and file is picked up by NFS protocol.

• Outbound Interface u2013 i.e. SAP->XI->third-party system:

XI is responsible for writing a file into a folder in the XI landscape. These files are transferred to the third-party system by executing UNIX scripts with secured protocol i.e. via sFTP.

Pre-Requisites:

• Public key should be exchanged between external systems and the PI system.

• UNIX shell script has to be developed and scheduled.

Advantages:

• Highly Secured.

• Ability to handle multiple secure file transfers over a single encrypted pipe .By using a single encrypted pipe, there are fewer holes in the corporate firewall.

Disadvantages:

• Two-Step process i.e. XI>Temporary folder>External System and vice-versa

• Files have to be temporarily stored in XI server.

• Multiple failure points i.e. XI and Unix script execution

• Maintenance of an external UNIX script.

• Difficulty in monitoring the execution of the shell script as it cannot be monitored thru XI.

• Need to generate keys and install it in the SFTP site as a pre-requisite i.e. SFTP clients must install keys on the server.

• SFTP uses keys rather than certificates. This means that it can't take advantage of the "chains of trust" paradigm facilitated through Certificate Authorities.

• Files from the XI server should be deleted/archived in a periodic manner to increase the disc space so that it will increase the performance.

Note: UNIX shell Script can be executed as a background job u2018or' can be triggered from SAP XI through OS command at File adapter level.

FTPS (File Transfer Protocol Using SSL/TLS):

This is a built-in feature of File adapter in XI. But SAP Java Cryptographic Toolkit must be deployed as a prerequisite. (Refer to note https://service.sap.com/sap/support/notes/821267 Question 28). By default following ports are used:

• Implict FTPs 990 (Control) and 989 (Data)

• Explicit FTPs 21 (Control) and 20 (Data)

Both use cases can be combined with active and passive mode.

Advantages:

• Direct transfer of files to/from third-party systems. It is not required to store the files in the XI server temporarily.

• Built-In feature from XI File adapter

• No extra effort in development and maintenance of Unix Script.

• Centralized Monitoring tool from XI

• FTPS uses certificates and therefore can take advantage of "chains of trust" paradigm facilitated through Certificate Authorities. This paradigm makes it possible for two entities to establish a trust relationship without directly exchanging security information, which is important for some applications.

Disadvantages:

• Requires opening multiple ports forenabling SSLin the firewall. So there are multiple holes in the corporate firewall.

• Not every FTP server supports FTPS and many that do, require a configuration change to activate the FTPS protocol extension.

• Cryptographic toolkit should be installed in XI system though it is not very complex or expensive.

Conclusion:

Though SFTP seems more secure as it works through one port, FTPS is easier to configure, monitor and maintain from XI point of view. However, the decision depends on many parameters like, cost/effort, flexibility in use, ease of maintenance, company security policy, failure possibilities etc.

regards

kummari

[Former Member]

Normally if you are going to quote someone else's work verbatim, it is polite to provide a link and mention that it is quoted from another source.

[Former Member]

Hi,

SFTP (Secure File Transfer Protocol)

"SSH File Transfer Protocol" or SFTP is a network protocol that provides file transfer and manipulation functionality over any reliable data stream. It is typically used with the SSH-2 protocol to provide secure file transfer. SFTP encrypts the session, preventing the casual detection of username, password or anything that is being transmitted. One key benefit to SFTP is its ability to handle multiple secure file transfers over a single encrypted pipe. By using a single encrypted pipe, there are fewer holes in the corporate firewall.

FTPS (FTP over SSL)

FTPS (FTP-SSL) is a real ftp that uses TSL/SSL to encrypt the control session and if required the data session. With FTPS, the control session is always encrypted, but the data session may not be always encrypted. FTPS is a file transport layer on top of SSL. SSL, or Secure Sockets Layer, is a method by which an encrypted u2018pipe' or tunnel is established between the FTP client and FTP server. Once the secure tunnel has been established (which is done using 128-bit encryption techniques), standard FTP is used to transfer data over the secure connection.

As per the latest SAP PI/XI support pack, it does not support SFTP via File Adapter.

So alternative approach to cater this requirement from XI is to make use of Unix Script at OS level to transfer the files from/to third-party systems.

Inbound Interface - i.e. third-party system ->XI->SAP:

File is transferred to a folder in SAP XI landscape from the third-party legacy system using UNIX Script with secured protocol. Once the file is ready in the XI landscape, File Adapter will poll this directory and file is picked up by NFS protocol.

Outbound Interface u2013 i.e. SAP->XI->third-party system:

XI is responsible for writing a file into a folder in the XI landscape. These files are transferred to the third-party system by executing UNIX scripts with secured protocol i.e. via sFTP.

The File Adapter does not support SFTP (File Transfer over SSH). It supports FTPS.

U may view this here at point 28 in SAP Note: 821267

Just an add-on, if u want to view the difference between FTPS (that XI supports) and SFTP, please refer this link

http://www.enterprisedt.com/forums/viewtopic.php?p=136&sid=28d66491b43c6bf90448deea4936bc15

. SAP is looking into this. Please see this thread on this discussion:

Thanks,

Madhu

[former_member537867]

Hi,

Yes it supports both.FTP/S is based on the widely known File Transfer Protocol, whereas SFTP is a Subsystem of SSH.

Refer this blog:

For SFTP you need a separate adapter which is not part of the Hightech and/or Automotiv-Solution. SEEBURGER sells SFTP not via the SAP marketplace, but it is available directly via SEEBURGER.

In case you meant FTP/S, then the FTPAdapter is capable of this. It can be configured via "Security/Authentication" in the communication channel. Select AuthTLS or Implicit depending on whether your FTP server runs on a dedicated port (implicit) or on the same port (AuthTLS) as your plain FTP server.

Seeburger Adapter will support SFTP in XI.

SFTP Adapter from Advantco at Swisscom which is certified by SAP, see the partner directory.

http://www.sap.com/ecosystem/customers/directories/SoftwareISVSolutions.epx?context=21B87D61C0F646A2...

Regards,

vinod.