Configuring SFTP cipher/mac algorithms for EFT outbound connections in the registry

THE INFORMATION IN THIS ARTICLE APPLIES TO:

• EFT Enterprise v6.3 and later
• EFT v4.x to v7.4.x stores advanced properties in the registry.
• EFT v8.x stores Advanced Properties in a JSON file.

EFT v8.0 and later store Advanced Properties in a JSON file. When you upgrade from EFT v7.4.x to EFT v8, the non-default settings that you have defined in the registry will be added to the Advanced Properties file during upgrade. (Default settings become part of the EFT configuration files.) For a more on how to use advanced properties, and a spreadsheet of the advanced properties, please refer to the "Advanced Properties" topic in the help for your version of EFT.

DISCUSSION

EFT currently does not provide the ability to configure the SFTP cipher/mac algorithms for outbound connections in the administration interface. The Site-level SFTP configuration for the inbound protocols in the interface does not affect the outbound settings. The ability to configure algorithms for outbound connections is available via registry settings or, in V8 and later, the AdvancedProperties.json file to enable/disable the various ciphers and macs.

The SFTP registry keys are automatically created by the ClientFTP.dll. The ClientFTP.dll writes to the registry when it finishes a transfer; therefore, you should edit the settings when there are no transfers occurring so that it loads your custom settings, and then it will save your custom settings back to the registry when it finishes the transfer. (Once ClientFTP.dll writes your custom settings to the registry, it will continue to use those settings.) You may have to run an initial outbound transfer after a clean install before the keys are created, or you can create them manually. (Again, do this when there is no outbound activity to avoid overwriting your changes.)

Prior to v8, the advanced properties resided under:  HKLM\SOFTWARE\Wow6432Node\GlobalSCAPE\TED 6\Settings\SecuritySFTP2\.

In EFT v8 and later, add the name:value pair to the AdvancedProperties.JSON file in EFT's \ProgramData\ directory as described in the "Advanced Properties" topic in the online help for your version of EFT.

{
"SFTP2_AES128":false
}

• Strings must be enclosed in quotation mark
• Numbers and literal names (false, null, or true) do not need quotation marks
• In the advancedproperties.json file, instead of 0 or 1, you must use false or true.

STATU:> Negotiated algorithms:
kex alg: ecdh-sha2-nistp521
host key alg: ssh-rsa
c2s encr alg: chacha20-poly1305@openssh.com
s2c encr alg: chacha20-poly1305@openssh.com
c2s mac alg: <implicit>
s2c mac alg: <implicit>
c2s comp alg: zlib
s2c comp alg: zlib