Quantcast
Channel: GlobalSCAPE Knowledge Base
Viewing all 479 articles
Browse latest View live

EFT Version Compatibility

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT v7.0.x and later

DISCUSSION

The table below lists each of the 7.x versions of EFT, the version numbers of the bundled modules, and the main features in each release.

(This table only highlights the main features added. Refer to https://www.globalscape.com/products/eft-enterprise/support for details of each release.)

EFT version

WTC/Shadowfax version

ME version

Outlook Add-in version

Insight

Main Features added

Date Released

7.4.13.15

1.4.7.5/

0.8.15

N/A

1.4.0.4

1.0.6

Supports EFT Enterprise
v7.4.7, 7.4.9,
7.4.10, 7.4.11

  • Fix for vulnerability
  • OpenSSH version updated to v7.9
  • OpenSSL version updated to v1.0.2q
  • Updated SQL Server drivers to allow use of newer Transport Layer Security (TLS) protocols
  • Support for Windows Server 2019
  • Added User Account action
  • Vulnerability patches available for earlier versions

03/14/2019

7.4.11

1.4.6.5/

0.8.15

N/A

1.4.0.3

1.0.6

Supports EFT Enterprise
v7.4.7, 7.4.9,
7.4.10, 7.4.11

  • Updated OpenSSL to 1.0.2p
  • Updated AS2 to latest libraries including choice of ciphers
  • Updated SFTP library in line with current FIPS compliance standards
  • Updated language support for French, German, Spanish and Dutch
  • Hid the disk quota feature by default as it remains experimental

10/24/2018

7.4.10

1.4.5

N/A

1.4.0

1.0.5

1.0.6 (7.4.10.6+)

  • Option to show full name vs. logon name in WTC profile
  • AD Site: Option to authenticate users via Active Directory while managing permissions internally in EFT
  • LDAP Site: Option to hide Forgot Password link for internal/external facing domains
  • LDAP Site: Option to not allow LDAP logins for external facing domains

08/21/2018

7.4.9

1.4.5

N/A

1.4.0.60

1.0.5

1.0.6 (7.4.9.11+)

  • RAM Agents can now perform client transfers to any server you designate, rather than only back to the home EFT Server
  • Shorter update intervals
  • New options for when an agent fails
  • System environment variables in remote agent rules
  • Remote Agent Condition for relevant File System triggers in event rules
  • LDAP Site: Automatically remove/disable account after X days of inactivity
  • Option to specify custom LDAP attributes that are configured at the site level and map to those in the user template level
  • Internal (LDAP) users must not authenticate when visiting external URL
  • Added ability to construct internal URL hyperlinks in notification emails based on recipient domain
  • Added ability to specify internal domain certificate in instance where direct connection is made that bypasses DMZ Gateway
  • Added ability for AD sites to automatically remove accounts after X days of inactivity

07/17/2018

7.4.7

1.4.5.11

Removed from Installer

1.4.0.3

1.0.5

1.0.6 (7.4.7.18+)

  • EFT SMB is now EFT Express
  • In EFT Enterprise, the High Security Module is now the Advanced Security module (ASM)
  • In EFT Express, the High Security Module is now the Express Security module (ESM)
  • The Advanced Authentication module (AAM) and Content Integrity Control (CIC) features have been merged into the Advanced Security module
  • The Mobile Transfer Client has been merged into EFT Enterprise (requires additional licenses in EFT Express)
  • The Cloud Connector module functionality has been merged into EFT
  • Added remote administration through DMZ Gateway®withSecure PNC
  • Added to EFT Outlook Add-In:Secure message delivery, encryption support, and digital signature support
  • Remote Agent updates
  • Agent status is changed from "Active" to "Enrolled"
  • Advanced Workflow Engine(AWE) updates; Before upgrading EFT Enterprise, you must upgrade to Insight v1.0.5 so that the AWE tables are created in Insight (to be able to see the AWE information in Insight

5/15/2018

7.4.5.6

1.4.5.3

4.3.0.5

1.0.1.3

1.0.3

1.0.4

  • Removed Java option code from login page
  • Added RAM and CCM
  • Added AWS S3 and Azure Blob storage to Connection Profiles
  • Added REST endpoint
  • Implement robots.txt so that WTC does not appear in web search
  • Added feature to Request Files in Workspaces
  • Added option to Secure Message Body in Workspaces
  • Removed local notes.txt file (version history)

11/21/2017

7.4.2.4

1.4.2.5

4.3.0.5

1.0.1.2

1.0.2

WTC unlimited now included in HTTP/S module; added HA unicast and drain mode, support for autoscaling in AWS; added SSL/TLS logging; added diffie-hellman-group-exchange-sha256 KEX; added WS drop-off and reply portals; removed SAT from EFT installer

08/29/2017

7.3.7.12

1.3.0.10

4.3.0.5

1.0.1.2

N

Support for SFTP KEX ciphers; Site search includes Connection profiles; SSL/TLS logging; password reset confir. email template; Workspaces invite comes from sender's email address instead of EFT SMTP address

08/01/2017

7.3.6.17

1.3.0

4.3.0

1.0.0.11

1.0.2

Added 2016 support, SMTP test, SMTP TLS, OCSP, ARM schema, SSL 1.0.2k; "1 million users" update. Change from .AUD

03/02/2017

7.2.9.9

1.2.1

4.2.2

NA

1.0.1

reg overrides for QUIT, PGP encrypt, PGP compression, more EFT.log entries

03/02/2017

7.2.8.5

1.2.1

4.2.2

NA

1.0.1

Upgraded WTC to 1.2.1, SSL SHA2, SFTP flow control

02/08/2017

7.3.5.4

1.3.0

4.3.0

1.0.0

1.0.1

Upgraded WTC, PGP logging, SSL SHA2, SFTP flow control

02/08/2017

7.3.3.21

1.2.2

4.3.0

1.0.0

1.0.1

AAM; SAML; Outlook Add-In; WebSSO

12/06/2016

7.3.2.8

1.2.2

4.3.0

NA

Y

WTC CAL (license requirement removed in v 7.4.2.4)

08/30/2016

7.3.0

1.2.1

4.2.2

NA

N

Acceleration

04/25/2016

7.2.6

1.2.1

4.2.2

NA

1.0.1

SSL v1.0.2j; HSTS

12/06/2016

7.2.4

1.1.3

4.2.2

NA

1.0.1

SSL v1.0.2h

07/05/2016

7.2.2

1.2.1

4.2.2

NA

1.0.1

SMB Automation modules:
Folder Monitor, Timer, File Transfer Client; backup run-on node; upgraded PGP

02/15/2016

7.2.1

1.2.1

4.2.2

NA

N

Workspaces update

02/10/2016

7.2.0

1.2.0

4.2.2

NA

N

Event Rule Folders; perform folder operation; if file exists; even rule admin

10/25/2015

7.1.5

1.1.2

4.2.2

NA

1.0.1

Fixes

10/23/2015

7.1.3

1.1.2

4.2.2

NA

1.0.1

SSL, PGP updates

07/22/2015

7.1.2

1.1.2

4.2.2

NA

1.0.1

Fixes, enhancements

06/24/2015

7.1

1.1.2

4.2.1

NA

1.0.1

Workspaces

03/02/2015

7.0.3 R2

1.1.1

4.1.1

NA

N

Updated to SSL v0.9.8zc

10/24/2014

7.0.3

1.1.0

4.1.0

NA

N

CIC module

10/13/2014

7.0.1

1.0.1

4.1.0

NA

N

HTTP CRC calculation logging

8/11/2014


What sort of DOM XSS (client XSS) mitigation techniques does EFT use?

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT v7. and later

QUESTION

What sort of DOM XSS (client XSS) mitigation techniques does EFT use?

ANSWER

Document Object Model (DOM)-based Cross-Site Scripting (XSS) is a client (browser)-side injection issue in which the attack is injected into the application during runtime in the client (browser) directly.

To mitigate DOM XSS, EFT behaves per the following guidelines:

  • Be careful with untrusted data: When forced to deal with untrusted data, EFT’s web client only uses it for displayable text (rather than execution) and instead relies on EFT server for the rest of its data for execution, including templated Javascript.
  • Use safe methods when dynamically rendering HTML: EFT’s web client uses methods and practices recommended by OWASP for creating dynamic interfaces.
  • Use caution when dealing with methods that implicitly eval() data and with eval() itself: EFT’s web client uses OWASP-approved methods of parsing JSON payloads.

EFT is NOT affected by the LibSSH vulnerability

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • All products

QUESTION

Is EFT affected by the LibSSH vulnerability?

ANSWER

No, EFT is not affected by the LibSSH vulnerability. The vulnerability pertains to libssh which was never used in EFT. 

EFT uses sshlib (1.81) from Bitvise. Bitvise does not share a common code with libssh. In Bitvise Software, authentication state is managed in separate client-side and server-side components. The server-side authentication component is not affected by this issue and will ignore any SSH_MSG_USERAUTH_SUCCESS messages sent by the client.

EFT v7.4.11.34 and later uses OpenSSH for SFTP. 

How EFT Addresses PCI DSS Requirements

$
0
0

EFT facilitates enforcing high security and compliance with the PCI Data Security Standard (PCI DSS), which provides detailed security compliance guidelines that can be used to provide hardened security for EFT, no matter which rules or standards by which your organization is measured. Each requirement and a description of how EFT helps comply with the requirements is described below. (Updated for PCI DSS v3.2)

Refer to the PCI Security Standards website for official documentation of the standard. You can download the PCI DSS Security Audit Procedures from https://www.pcisecuritystandards.org.

Compensating Controls

From the PCI DSS Security Auditing Procedures document:

Compensating controls may be considered for most PCI DSS requirements when an entity cannot meet a requirement explicitly as stated, due to legitimate technical or documented business constraints, but has sufficiently mitigated the risk associated with the requirement through implementation of other, or compensating, controls.

When EFT warns you of a non-compliant setting, you will be given the choice to fix the problem or proceed with the non-compliant setting. If you choose to proceed in violation of the PCI DSS, you will be asked to specify a compensating control, i.e. an alternate hardware, software, or internal policy that satisfies the requirement in some other way (ref. "Compensating Controls" in the PCI DSS for more information). The controls you document will appear in the PCI DSS Compliance report, which you can provide to Qualified Security Assessors (QSAs) and Approved Scanning Vendors (ASVs), individuals who are certified by the PCI Security Standards Council as being qualified to validate compliance to the PCI DSS.

PCI DSS Requirements Addressed

EFT facilitates compliance with applicable PCI DSS requirements. The PCI DSS requirements related to physical security and cardholder database security are not applicable to EFT; however, you should place the Server computer in a secured area, such as a locked server room or network operations center.

Requirement 1: Install and Maintain a Firewall Configuration to Protect Cardholder Data

 

PCI DSS Requirement

How Requirement is Addressed with EFT

1.1 Establish and implement firewall and router configuration standards.

Requires measures external to EFT.

1.2 Build firewall and router configurations that restrict connections between untrusted networks and any system components in the cardholder data environment.

Requires measures external to EFT; however EFT also provides a robust set of IP access filters to control access to EFT and/or the DMZ Gateway.

1.3  Prohibit direct public access between the Internet and any system component in the cardholder data environment.

Storing cardholder in the DMZ or other untrusted network is expressly prohibited by PCI DSS (1.3.7). And for security best practices you should not allow inbound connections to originate from untrusted into trusted zones.

EFT’s optional DMZ Gateway module solves both of these problems. Refer to https://www.globalscape.com/managed-file-transfer/dmz-gateway for details of DMZ Gateway.

 

1.3.1 Implement a DMZ to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports.

EFT in combination with the DMZ Gateway module facilitates compliance with this requirement.

 

1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ.

When EFT is used in combination with the DMZ Gateway, no internal inbound ports need be opened into the trusted network, hence all inbound traffic will be restricted to IP addresses within the DMZ.

 

1.3.3 Implement anti-spoofing measures to detect and block forged source IP addresses from entering the network.

The need for inbound connections between the DMZ and the internal network is eliminated when using EFT in combination with the DMZ Gateway module.

 

1.3.4 Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet.

Requires measures external to EFT.

 

1.3.5 Permit only “established” connections into the network.

EFT can be configured* to use the DMZ Gateway as a SOCKS5 proxy for outbound traffic. Offloading files using EFT though the DMZ Gateway means your internal IP address won’t be exposed (1.3.48). Additional steps may be required to fulfill this requirement, such as DLP and deep content inspection tools, before files are submitted to EFT for offloading. *Requires DMZ Gateway.

 

1.3.6 Place system components that store cardholder data (such as a database) in an internal network zone, segregated from the DMZ and other untrusted networks.

EFT, when combined with the DMZ Gateway, eliminates the need to store data in the DMZ.

 

1.3.7 Do not disclose private IP addresses and routing information to unauthorized parties.

Your internal IP addressing scheme is never exposed when EFT is used in combination with the DMZ Gateway.

1.4 Install personal firewall software on any mobile and/or employee-owned computers

Requires measures external to EFT.

1.5 Document policies and procedures

Requires measures external to EFT.

Requirement 2: Do Not Use Vendor-Supplied Defaults for System Passwords and Other Security Parameters

PCI DSS Requirement

How Requirement is Addressed with EFT

2.1 Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network.

With the Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express) and a high security-enabled Site, EFT detects whether any default values are specified for Admin login port (1100), DMZ Gateway port (44500), FTP banner message, or SFTP banner message, and will prompt you to change them. No default passwords, usernames, certificates, or keys are used.

2.2 Develop configuration standards for all system components.

Refer to the specific sub-requirements below.

 

2.2.1 Implement only one primary function per server

EFT’s primary function is File Transfer. It is up to the administrator to segregate servers.

 

2.2.2 Enable only necessary services, protocols, daemons, etc., as required for the function of the system.

It is up to the administrator to determine whether an enabled protocol is necessary. No protocol is enabled by default.

 

2.2.3 Implement additional security features for any required services, protocols, or daemons that are considered insecure.

Any unsecure protocols such as plaintext FTP or HTTP are automatically detected* and you are prompted to change them or present a compensating control.

*Requires Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express) and creation of a PCI DSS Site.

 

2.2.4 Configure system security parameters to prevent misuse.

With the Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express) and a PCI DSS Site, EFT monitors and warns when

 

2.2.5 Remove all unnecessary functionality

It is up to the administrator to remove any scripts, custom commands, AWE workflows or similar user-created files that are no longer in use.

2.3 Encrypt all non-console administrative access using strong cryptography.

The status of non-console (remote) access settings are monitored* and you are warned if SSL is not enabled and given the option to either disable remote administration or enable SSL. *Requires Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express) and creation of a PCI DSS Site

2.4 - 2.6 Inventory maintenance, policy documentation and enforcement, and shared hosting requirements

Requires measures external to EFT.

Requirement 3: Protect Stored Cardholder Data

PCI DSS Requirement

How Requirement is Addressed with EFT

3.1 Keep cardholder data storage to a minimum by implementing data retention and disposal policies, procedures and processes.

EFT provides a scheduled, automatic Clean-up Action*. Deleted files can be purged** by writing over the initial data using encrypted and/or pseudorandom data (PCI DSS 9.8). Disk quotas can be set to limit data storage. *Requires EFT Enterprise. **Requires Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express)

3.2 Do not store sensitive authentication data after authorization (even if encrypted).

3.2.1-3 Refers to card sensitive authentication data (SAD), which should never be stored on the server. Use a third-party DLP or similar tool to detect and prevent SAD storage.

3.3 Mask PAN when displayed

Not applicable to EFT, because EFT cannot display that data.

3.4 Render PAN, at minimum, unreadable anywhere it is stored.

Encrypt PAN or other sensitive data using EFT’s optional OpenPGP encryption module or third-party encryption utilities.

 

3.4.1 If disk encryption is used, logical access must be managed independently of native operating system authentication and access control mechanisms.

EFT will detect and warn if Microsoft Encrypting File System (EFS) is being used.

(Requires Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express) and creation of a PCI DSS Site.)

3.5 Document and implement procedures to protect keys

Mostly requires measures external to EFT; however access to keys through the administrator interface is limited to administrator roles with Site or Server access only.

3.6 Fully document and implement all key management processes and procedures

Mostly requires measures external to EFT;however, per 3.6.1 EFT will disallow creation of 512 or lesser certificate/key bit lengths. Default bit-length is set to 2048 bits for new keys. When importing SSL or SFTP keys, a warning will appear if a weak key is imported. *Requires Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express) and creation of a PCI DSS Site

3.7 Document policies and procedures

Requires measures external to EFT.

Requirement 4: Encrypt Transmission of Cardholder Data across Open, Public Networks

PCI DSS Requirement

How Requirement is Addressed with EFT

4.1 >Use strong cryptography and security protocols

Secure protocols such as SSL, TLS, and SFTP (SSH2) are provided for data transmission. Secure data transmission is enforced* by automatically redirecting  incoming HTTP traffic to HTTPS. *Requires Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express)

4.2 - 4.3 Never send unprotected PANs by end-user messaging technologies; document security policies and procedures

Requires measures external to EFT.

Requirement 5: Use and Regularly Update Anti-Virus Software

PCI DSS Requirement

How Requirement is Addressed with EFT

5.1 - 5.4  Anti-virus requirements.

Requires measures external to EFT

Requirement 6: Develop and Maintain Secure Systems and Applications

PCI DSS Requirement

How Requirement is Addressed with EFT

6.1 Establish a process to identify security vulnerabilities

Globalscape has formal processes for dealing with potential security vulnerabilities discovered in EFT, including an escalation process, a risk assessment that includes Common Vulnerability Scoring System (CVSS) risk ranking, and a process for notifying customers of critical patches or workarounds.

6.2 Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release.

The latest version of EFT is always available from the Globalscape website. Customers are automatically notified upon critical patch availability. It is up to the customer to install the patch within the designated one-month window.

6.3 Develop internal and external software applications securely.

Globalscape takes a number steps to develop secure software, as documented here: https://kb.globalscape.com/KnowledgebaseArticle11061.aspx.

 

6.3.1 Removal of custom application accounts, user IDs, and passwords before applications become active or are released to customers

Only applies to Professional Services engagements and should be verified prior to deployment.

 

6.3.2 Review of custom code prior to release to production or customers in order to identify any potential coding vulnerability.

Only applies to Professional Services engagements and should be verified prior to deployment.

6.4 Follow change control procedures for all changes to system components.

Requires measures external to EFT.

6.5 Address common coding vulnerabilities in software-development processes

Globalscape takes a number steps to develop secure software, as documented here: https://kb.globalscape.com/KnowledgebaseArticle11061.aspx.

6.6 For public-facing web applications, address new threats and vulnerabilities on an ongoing basis.

Requires customer to run a security scan. However, Globalscape also performs routine third-party security scans of EFT’s public-facing web interfaces as part of its quality assurance process.

6.7 Document policies and procedures

Requires measures external to EFT.

Requirement 7: Restrict Access to Cardholder Data by Business Need-to-Know

PCI DSS Requirement

How Requirement is Addressed with EFT

7.1 Limit access to system components and cardholder data to only those individuals whose job requires such access.

EFT provides complete control administrator and user access to resources, with administrator accounts completely segregated from user accounts.

7.2 Establish an access control system for systems components with multiple users that restricts access based on a user’s need to know, and is set to “deny all” unless specifically allowed.

Segregation and control of user access is achieved using unique accounts, permission groups, virtual folders, and settings templates Segregation and control of administrator access is accomplished via delegated, role-based administrator accounts

7.3 Document policies and procedures.

Requires measures external to EFT.

Requirement 8: Assign a Unique ID to Each Person with Computer Access

PCI DSS Requirement

How Requirement is Addressed with EFT

8.1 Define and implement policies and procedures to ensure proper user identification management

EFT enforces unique usernames for both users and administrators (8.1.1), provides granular administrative controls over user provisioning and authorization (8.1.2), allows user and admin account revocation (8.1.3), provides automatic removal of inactive users after 90 days (8.1.4), includes controls for temporarily enabling/disabling users (8.1.5), auto-locks users after six failed login attempts (8.1.6), either for a period of time or permanently until the admin unbans (8.1.7), and automatically expires sessions after 15 minutes of inactivity (8.1.8)

8.2 In addition to assigning a unique ID, ensure proper user authentication.

 

EFT supports various combinations of password, certificate, two-factor, and public-key authentication mechanisms (8.2), secures passwords during transmission (assumes SSL or SSH), and storage (with a one way [uniquely salted] hash)(8.2.1), verifies identity before allowing password reset or lost username retrieval according to OWASP guidelines (8.2.2), includes minimum length and a number of complexity options (8.2.3), expires and forces password change after 90 days (8.2.4), disallows password re-use, internal dictionary match, or username match (8.2.5), and can force first time use password reset (8.2.6).

8.3 Incorporate two-factor authentication for remote network access.

 

NOTE: EFT does not provide multifactor authentication for remote (non-console) administrator access.

 

Although EFT supports 2FA, this requirement is about network access, such as what is normally done over a VPN. For compliance with PCI DSS v3.2, you should disable remote (non-console) administrator access.

From the PCI DSS v3.2, "Multi-factor authentication is not required at both the system-level and application-level for a particular system component. Multi-factor authentication can be performed either upon authentication to the particular network or to the system component."

8.4 Document and communicate authentication procedures and policies

Requires measures external to EFT.

8.5 Do not use group, shared, or generic IDs, passwords, or other authentication methods

The "Anonymous" password type is disallowed on a high-security-enabled Site (Requires Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express) ). To comply with 8.5.1 you will need to create unique accounts for service provider access, should there ever be a need to provide such access.

8.6 Requirements for unique and controlled access using non-standard authentication mechanisms.

Requires measures external to EFT as most of these are physically provisioned to the user.

8.7 All access to any database containing cardholder data is restricted.

EFT provides granular controls over which administrators can access EFT’s reports from within the EFT Server console; however controls over access to the database (including the data itself) requires measures external to EFT.

8.8 Document policies and procedures.

Requires measures external to EFT

Requirement 9: Restrict Physical Access to Cardholder Data

PCI DSS Requirement

How Requirement is Addressed with EFT

9.1 - 9.7 Requirements related to physical access to the cardholder environment.

Requires measures external to EFT.

9.8 Destroy media when it is no longer needed for business or legal reasons. Cardholder data on electronic media must be rendered unrecoverable via a secure wipe program

EFT includes a data-wiping algorithm for sanitizing deleted data on disk. (Requires Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express) .)

9.9 Protect devices that capture payment card data via direct physical interaction

Requires measures external to EFT

9.10 Document policies and procedures.

Requires measures external to EFT

Requirement 10: Track and Monitor All Access to Network Resources and Cardholder Data

PCI DSS Requirement

How Requirement is Addressed with EFT

10.1 Implement audit trails to link all access to system components to each individual user

Preconfigured reports of all activity (including administrator actions*) within EFT can be generated on demand with the Auditing and Reporting Module (ARM) *Requires ARM and Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express) .

10.2 Implement automated audit trails for all system components

EFT will audit* all user access to data (10.2.1), and all administrator changes** to configuration settings (10.2.2). Access to audit trails, invalid logical access, authentication mechanisms, object creation, and initialization of audit logs (10.2.3-2.7) is managed at the database server.

*Requires ARM and Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express)

10.3 Record audit trail entries for all system components

EFT audits* user identity (10.3.1), type of transaction (10.3.2), date and time of transaction (10.3.3), transaction result (10.3.4), remote and local IP (10.3.5), and objects affected (10.3.6). *Requires ARM

10.4 Synchronize critical system clocks and times

Requires measures external to EFT.

10.5 Secure audit trails so that they cannot be altered.

Audited data integrity depends on the chosen database solution and authentication architecture. EFT supports auditing* to a central SQL or Oracle** server. *Requires ARM **Requires EFT Enterprise

10.6 Review log sand security events for all system components (10.6.1) at least daily

A daily PCI DSS Compliance report can be generated by EFT and sent via email to the appropriate recipient(s). Administrators can also attach any other canned or administrator created report to the daily email. (Requires both ARM and Advanced Security module (for EFT Enterprise) or the Express Security module (for EFT Express) .)

10.7 Retain audit trail history for at least one year

Requires measures external to EFT.

10.8 Implement a process for the timely detection and reporting of failures of critical security control systems

EFT logs and reports audit EFT-specific systems; auditing of other network systems requires measures external to EFT.

10.9 Document policies and procedures

Requires measures external to EFT

Requirement 11: Regularly Test Security Systems and Processes

PCI DSS Requirement

How Requirement is Addressed with EFT

11.1 - 11.6 Requirements relating to regular testing of security systems and processes.

Requires measures external to EFT.

Requirement 12: Maintain a Policy that Addresses Information Security

PCI DSS Requirement

How Requirement is Addressed with EFT

12.1 - 12.10 Maintain a policy that addresses information security for all personnel

Requires measures external to EFT

Timeout occurs when attempting to generate PCI DSS report

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT, v7.x

SYMPTOM

Timeout occurs when attempting to generate PCI DSS reports.

CAUSE

Standards such as PCI DSS disallow the use of encryption technologies where the keys required for encryption/decryption reside on the systems within PCI DSS scope. Window’s EFS keys do reside on the operating system. When the PCI DSS report is generated, EFT checks whether the Site's VFS system has Windows Encrypted File System (EFS), causing warnings in the report. This can cause the report generation to take a long time when a large number of folders have EFS enabled.

RESOLUTION

Disable checks for EFS when generating the PCI DSS

(In EFT v7.4 and later, EFT-based encrypted folders are available as an alternative to EFS, and does not interfere with standards requirements.)

HKEY_LOCAL_MACHINE\Software\WOW6432Node\GlobalSCAPE Inc.\EFT Server 7.1\DisableEFSChecksForPCIReport

Type: DWORD

Value name: DisableEFSChecksForPCIReport

Default Value: 1

  • When set to 1, EFT will skip those long-running EFS checks
  • When set to 0 or not present, EFT will perform the checks.

Cached: yes

Backup/Restore: yes

Conceal WTC and Its Content from Searches

$
0
0

The WTC/Workspaces pages and content is visible to Web searches. A file named robots.txt on the server tells web crawling robots whether to ignore the site. You can create a registry key to prevent WTC/Workspaces pages and content from appearing in search results.  In EFT, the robots.txt file is located (by default) in C:\Program Files (x86)\Globalscape\EFT Server Enterprise\web\public\EFTClient.

To enable or disable searches

  1. Create the following registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GlobalSCAPE Inc.\EFT Server 7.4\

  2. Add a DWORD and name it ServeRobotsFile

  3. Set the DWORD to 0 (disabled, the default) or 1 (enabled)

  4. Restart the EFT server service.

The EFT.log file indicates that the key was read in at startup. The first log is initial startup, 0, the second one is after changing it to 1 and then restarting the service:

09-27-17 15:08:26,526 [2992] INFO AdvancedProperties <> - HKEY_LOCAL_MACHINE\SOFTWARE\GlobalSCAPE Inc.\EFT Server 7.4\ServeRobotsFile=0

09-27-17 15:57:26,913 [1096] INFO AdvancedProperties <> - HKEY_LOCAL_MACHINE\SOFTWARE\GlobalSCAPE Inc.\EFT Server 7.4\ServeRobotsFile=1

Does EFT’s web transfer client (WTC) use cookies, and are any of those cookies used in a way that could violate privacy standards such as GDPR, or that can be used for tracking or identifying users?

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT v7.4.13.15 and later

QUESTION

Does EFT’s web transfer client (WTC) use cookies, and are any of those cookies used in a way that could violate privacy standards such as GDPR, or that can be used for tracking or identifying users?

ANSWER

EFT does not use its cookies for anything related to PII/PD or for the purpose identifying users or tracking their behavior.

Typically it is websites or certain SaaS services that misuse cookies for tracking and/or identifying users, something which EFT has no reason for, given its specific purpose as a Managed File Transfer (MFT) server operated in our customer’s environment.

Cookies:

  • csrftoken (previously token) - used as part of our double cookie submit CSRF prevention
  • downloadsession - used in the direct download workflow
  • mfatoken (previously loginsession) - used for login workflows that use multi-factored authentication (radius, etc.)
  • passresetsession - used when resetting password
  • passchangesession - used when requesting a change password (comes before reset)
  • samlssologgedout - SAML-logout related
  • savedpath - used to save folder listing context in certain workflows for WTC (allows WTC to drop you into proper location after certain actions)
  • switchtoptc - legacy, used to switch to non-js version of web client
  • twspath - used for directory look-up in certain circumstances using workspaces
  • usewtc - used to prevent obsolete clients
  • websessionid - holds session information after logging into the WTC, used for authentication

Purely client side:

  • currentSort - keeps track of sorting of the file listing
  • i18next - keeps track of localization (language) information
  • saveDir - keeps track of the last visited directory*
  • showThumbnails - keeps track of thumbnail option selection
  • showSiteInitPopups - determines if initial toast (popup) notification should be shown that outlines current browser limitations
  • tosAccepted - keeps track if a user has accepted the TOS to prevent it from appearing every time (if using TOS system + unless specifically set to show every time)
  • UserChosenDefaultLoggingLevel - keeps track of user set logging level
  • variant - handles context for portals in various situations

*It may be possible but is highly unlikely that folders are named by users in a way that either leaks confidential data or constitutes PII; however, it could be argued that the benefits of recalling the user’s current directory between login session far outweighs the small risk that a folder’s naming convention violates company policy.

How do email notifications work in EFT Arcus?

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT Arcus

QUESTION

How do email notifications work in EFT Arcus?

ANSWER

Your own SMTP gateway or a DNS SPF Record is required if you want the default settings SMTP gateway in EFT Arcus to send email on your behalf. A Sender Policy Framework (SPF) record is a type of Domain Name Service (DNS) TXT record that identifies which mail servers are permitted to send email on behalf of your domain. The purpose of an SPF record is to detect and prevent spammers from sending messages with forged "From" addresses on your domain.

Certain SMTP servers, such as Gmail's SMTP server, have additional security options that, when enabled, could cause email to not work. Gmail has a setting that, if enabled, locks down the service to accept oAuth authentication only, which our SMTP service (as a client) does not support. Enabling that option in Gmail will cause incompatibility with EFT Arcus. If Gmail is configured to use two-step authentication, you cannot disable the oAuth option. As explained in https://support.google.com/accounts/answer/6010255, if you receive a "password incorrect" error, use Option 2 to enable "Access for less secure apps." (Disabling the oAuth option will still allow for SSL and secure SMTP communications, so there is no real harm in turning it off.)


Unable to set refresh interval on LDAP/AD site when EFT configured in HA

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT, v7.x and later

SYMPTOM

Unable to set refresh interval on LDAP/AD site when EFT configured in HA.

CAUSE

When creating an LDAP Site on an HA node, the Refresh User Database is disabled, because the user list must be synchronized on all nodes at the same time.

RESOLUTION/WORKAROUND

Create the user at login: The user that has been newly added to LDAP/AD logs in to EFT, and EFT creates the account (in EFT) for them.

Alternatively, you can use the COM API to synch "on demand":

  • Site.ForceSynchronizeUserDatabase () syncs all
  • Site.ForceSynchronizeUser (bstrUser As String)

Force Synchronize launches the user database synchronization thread (asynchronously) in EFT (equivalent to clicking View > Refresh User Database).

This method does not change the client's COM object. You must use the Server.RefreshSettings() method after waiting a suitable amount of time for the database synchronization to complete.

If a call to any COM method throws an "MX Error: 52 (0x00000034)", this means that the COM object needs to invoke RefreshSettings.

 

Understanding your EFT Arcus monthly charges

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT Arcus

DISCUSSION

Your EFT Arcus server is hosted on a virtual machine in the Microsoft Azure cloud computing platform. Microsoft charges for using its services based on resource consumption.

You receive an invoice and usage report at the end of each month for your usage of EFT Arcus for that month. The billing cycle begins on the day your EFT Arcus environment is deployed (or when the trial period expires and you choose to move to the paid service).

All TRAFFIC going through EFT Arcus is monitored, and all TRAFFIC is measured as data transfer usage.

The following usage metrics are measured:

  • Users - Number of users that can create and share a Workspace
  • Workflow Steps - Actions within an EFT Event Rule and Actions within an Advanced Workflow Engine workflow.
  • Remote Agents Usage - Number of Remote Agents deployed
  • Data Transfer Usage - The amount of data (GB) transferred to and from EFT Arcus, which includes:
    • Files transferred using Event Rules, WTC, Workspaces, or EFT Outlook Add-In<
    • Connecting to EFT Arcus to view or edit folders, modify server administration settings, and for self-service management, even without uploading or downloading anything
  • Data Storage Usage - The amount of data (GB) stored in data store(s)
  • VPN Usage - VPN connection and usage incurred when a VPN is used

How can I reduce my monthly EFT Arcus bill?

  • Limit the number of users who can create and share Workspaces
  • Avoid duplication or unnecessary Event Rule/AWE steps (Engage Professional Services to optimize your Event Rules and workflows)
  • Attend the "EFT Automation" and "EFT Advanced Workflow Engine (AWE) Essentials" training to learn how to create efficient Event Rules and workflows

Measuring EFT Performance with Perfmon

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

Overview

This document outlines the procedures necessary to capture and analyze key performance metrics using Windows’ built-in performance measurement tool, Perfmon, to help EFT administrators.

  • Troubleshoot problematic behavior by highlight performance bottlenecks
  • Baseline performance when operating with a given configuration or version, then benchmark and compare performance when introducing changes to configuration or versions
  • Perform capacity planning by evaluating performance trends over time

To measure performance, Windows expose a large number of performance counters, which Perfmon can sample at specific intervals, displaying and optionally recording those results over time. In addition to Windows’ default counters, EFT exposes a large number of counters of its own, providing valuable insight into EFT’s internal state. By juxtaposing Windows and EFT counters a qualified individual could assess how the system's resources are being affected by applications. For example, if by adding 1 additional connected user to the application, Private Bytes increases by 1 MB, and another 10 users increases by Private Byte usage by another 10MB, we can extrapolate that Private Bytes use will increase in proportion to users added at the rate of approximately 1MB per connected user.

Counter Creation

To create and capture counters, you can run Perfmon and view counter results as they are captured in real-time, or you can create a Data Collector Set (DCS), which will track a set of desired counters over time, and you can subsequently view the results of lengthy capture after the fact.

Real-Time Counters

Real-Time Capture*

  1. Open Perfmon from start menu
  2. Navigate to Monitoring Tools > Performance Monitor
  3. Add the desired counters (see below)
  4. View results in real-time

*The downside of real-time capturing in the Perfmon tool is that you cannot save or load a set of counters. See next for instructions on how to do so using the command line option.

Create then Export a Perfmon Config

  1. Open a command prompt
  2. Run “perfmon /sys”
  3. Add the desired counters (see table below)
  4. From the File menu, select “Save” then export the configuration exported previously

Load A Perfmon Config into a Running Counter

  1. Open a command prompt
  2. Run “perfmon /sys”
  3. From the File menu, select “Load” then import the configuration exported previously

Long-Term Counters (Data Collectors)

Viewing counter measurements in real-time is useful when troubleshooting or evaluating performance within a narrow time window, such as when attempting to diagnose a slow performance problem. For capacity planning or troubleshooting for rare events (sporadic non-responsiveness), it is preferable to run a set of counters over a longer period, perhaps taking snapshots at longer intervals, and then analyze the resulting measurements after a period of hours or even days. For capacity planning, it may be advisable to run a set of counters for a period of a day, and then repeating at regular intervals (such as weekly), and then analyzing the differences over a longer period (month) to gain a big picture view.

Creating a Data Collector Set (DCS)

  1. Open Perfmon from start menu
  2. Navigate to Data Collector Sets > User Defined > Right click -> New > Data Collector Set
  3. Choose to create one from a template (see importing a DCS below) or create manually
  4. If manually, add all the desired counters

Exporting (Saving) a Data Collector Set (DCS)

  1. Open Perfmon from start menu
  2. Navigate to Data Collector Sets > User Defined
  3. Select a previously created DCS
  4. Right Click and select “Save Template”
  5. Save the file (XML format)

Importing a DCS

  1. Follow the steps under Creating a DCS
  2. At step 3, select the XML file you exported at step 4 under Exporting DCS

Performance Counter Alerts

You can also create long running Data Collectors that can alert you when your user-defined counter thresholds are exceeded (or fall below). These can be extremely valuable for detecting and preventing problems before they occur. For example, if you know that your maximum ARM Queue Size is set to 100,000, then you could set the counter alert at 90,000 so that you are alerted with ample time to react (maybe check on health of SQL or EFT system). The thresholds are not all that sophisticated (e.g. detect if matches criteria over X number of samples), but is good enough for certain measurements that when hit even once, could mean problems such as outages.

To Create a Data Collector Set (DCS) with Performance Counter Monitors

  1. Open Perfmon from start menu
  2. Navigate to Data Collector Sets > User Defined > Right click -> New > Data Collector Set
  3. Choose to create a counter manually (Advanced) then click Next
  4. Select the Performance Counter Alert button followed by Next
  5. Add a counter and set a threshold, repeat as necessary and click Finish when done.

Important System Counters

For the purpose of evaluating EFT’s performance, you will need to monitor both system and application (EFT) counters. The following table outlines a set of critical counters related to CPU, disk, memory, and network resources, while also calling out specific counters that EFT publishes. Keep in mind that this is a small subset of overall counters available, so feel free to add others that you think are important. In the Expected Values section, we outline the threshold values that if exceeded could indicate a problem with that particular resource. In the next section we will provide more detail on how to read and analyze data collector results.

There are plenty of resources online that provide in-depth analysis on how to read and understand various performance counters. Below are just a few resources you can find with a simple Google search:

Specific disk counters: https://blogs.technet.microsoft.com/askcore/2012/02/07/measuring-disk-latency-with-windows-performance-monitor-perfmon/

More disk counter info: https://blogs.technet.microsoft.com/askcore/2012/03/16/windows-performance-monitor-disk-counters-explained/#comments

Memory counters: https://docs.microsoft.com/en-us/azure/monitoring/infrastructure-health/vmhealth-windows/winserver-memory-pctcommitted

Network counters: https://docs.microsoft.com/en-us/windows-server/networking/technologies/network-subsystem/net-sub-performance-counters

Advice on measure the performance of a SQL server by monitoring SQL server objects and counters: https://docs.microsoft.com/en-us/sql/relational-databases/performance-monitor/sql-server-xtp-in-memory-oltp-performance-counters?view=sql-server-2017

CPU counters: https://docs.microsoft.com/en-us/sql/relational-databases/performance-monitor/monitor-cpu-usage?view=sql-server-2017

Counter

Information Provided

Expected Value / Notes

Processor (CPU)

 

 

Processor\% Processor Time

The percentage of time that the processor spends active, and the percent of processing capacity being used by the processor. Note that this is the same counter as Processor Information > Processor Time

Less than 85% on average. Note that this is a general measurement of how busy the system is, and it is expected for the CPU to remain while busy; however, if pegged at almost 100% utilization and all other metrics are low, then you might be CPU bound and should consider investing in a more performant system.

Processor\% User Time

This counter is reflective of what the CPU is doing on behalf of applications, such as looping through an array or running functions within the application itself that don’t involve the system like writing a file to disk (which would fall under privileged time).

Less than 85% on average. User Time and Privileged Time should be looked at as a unit. If PT is consistently higher than UT and the application is performing poorly then it is possible that the CPU is all tied up trying to handle privileged requests that may or may not be tied to the specific application being monitored.

Processor\% Privileged Time

This counter measures the % of CPU utilization dedicated to handling system-oriented tasks that are of higher “privilege” than user (or application) oriented tasks. Generally, the combination of privileged and user time will equal the total processor time.

Less than 85% on average. User Time and Privileged Time should be looked at as a unit. If PT is consistently higher than UT and the application is performing poorly then it is possible that the CPU is all tied up trying to handle privileged requests that may or may not be tied to the specific application being monitored.

Process
(the app)

 

Process (csftps.exe)\

% Privileged, Processor, User Time

This is the same as the above three measurements, however it isolates the measurement of CPU utilization so that it is strictly associated with the EFT server service executable. As such it will be a subset of the overall process.

Less than 85% on average. Keep in mind these are a subset of the three measurements that are taken for the entire system. The reason these are helpful is in case you want to isolate whether EFT is consuming the majority of resources or some other application, such as an AV tool running in the background.

Process (csftps.exe)\

Handle Count, Thread Count

These two values are distinct but related. A thread is a set of separate, sequential set of instructions executed by the CPU on behalf of the application. Handles are a logical associated with a resource, such as a file, memory location, or dialog. A thread is typically used to open or obtain a handle to said resource.

Steady values. Thread counts increasing with utilization is normal, as is an increase in handles.; however, if handles or threads are increasing in an unbounded fashion over time, then EFT could be experiencing a memory leak. Note that a large number of threads or handles (even in the tens of thousands) is ok. It is the constant increase with no decrease over time even when server utilization fluctuates or drops that should raise a red flag.

Process (csftps.exe)\

Private Bytes

This is generally (with many exceptions) a value that can be associated with how much memory an application is consuming.

Less than 2GB. Note that there are many factors in determining both memory consumption and/or memory leaks. An increase in memory as utilization increase is to be expected; however unbounded increase or memory utilization associated with csftps.exe exceed 2GB should be looked at.

System

 

 

System\

Processor Queue Length

Shows the number of threads waiting to be serviced by the processor. Waiting threads translates directly into slower performance.

No greater than 5 times the number of processors running, on average. Take the number shown and divide by the number of logical processors. If that number is greater than 5, then more processing power might be needed. Google “Processor Queue Length” for in-depth analysis of this metric.

Disk

 

 

Physical Disk\ % Idle Time

Amount of time your disks are idle or not performing any action. You can also use % Disk Write Time and % Disk Read Time or just %Disk Time to assess the opposite of idle time. Generally, you don’t need all four. IMPORTANT: While _Total is a valid instance, you should select the actual physical disk that is being utilized. E.g. “c:\”

Greater than 85%, on average. If %Idle time falls below %20 and stays there then it is in constant read or write mode. Couple this measurement with others such as disk queue length and read/writes a second (measured against the disk’s operational specs) to determine if the disk is a bottleneck.

Physical Disk\ Disk Reads /sec and Disk Writes/sec

Overall rate of read and/or write operations on the disk (Can be used to determine IOP’s to evaluate hardware needs and as a benchmark for hardware upgrades.)

Less than 80%. This value is typically the opposite of %Idle Time. Keep in mind that I/O will be high during high load situations.

Physical Disk\ Current and Average Disk Queue Length

Current Disk Queue Length is a snapshot of queued of requests for either read or write at the time when a measurement is taken. The result can be a bit misleading which is why you also want to look at Average Disk Queue length, which derives an average of values between measurement intervals.

Calculating a disk bottleneck off of these numbers is difficult. If back to back measurements of Current Disk Queue Length are the same, then Average Disk Queue Length can be used to measure outstanding I/O requests (otherwise it cannot). It is best to have someone with expertise evaluate these results.

Physical Disk\

Avg. Disk Sec/Read and Write Avg

This is a measurement of the average time it takes in seconds to read (or write) from/to disk. Note that the latency measured is the time it takes from when the partition manager receives the i/o request to the time it completes.

Less than 20. This value is calculated with millisecond precision (the default multiplier is 1000). A value of “5” shown in the log is .005 of a second. If the value increases under load to where 10s of milliseconds latency is detected, on average, it could signify a slowness beneath the partition manager (class driver, or port driver, or device miniport driver, or disk subsystem)

Physical Disk\

Disk Bytes\sec

Measures the disk I/O both read and write

Less than system specs for that disk’s max throughput. There is no specific number to look for, but rather a comparison between the average bytes in the I/O compared to what the disk subsystem is actually capable of.

Others:

Split IO/Sec can be useful for detecting a heavily fragmented disk.

%Free space is useful in case you didn’t realize you were running out of space (especially when measured over time.

 

Memory

 

 

Memory\

Available Mbytes

The amount of free memory.

Less than 80% utilization. If higher and sustained then look into increasing they system’s memory.

Memory\

% Committed Bytes in Use

This is the ratio of Committed Bytes to the Commit Limit

Less than 80% utilization. If higher and sustained then look into increasing they system’s memory.

Network

 

 

Network Interface\Bytes Total/Sec

This counter simply measures the overall (inbound and outbound) bytes transferred over the wire at the moment in time the snapshot was taken. When adding this counter, be sure to specify the correct network interface, or just specify all if you aren’t sure which one is being utilized.

Less than 70% utilization, on average. To determine utilization, you must first determine what your available bandwidth and NIC is capable of. Also, the total bytes should be multiplied by 8 to get the Bits per second, as most measurements for throughput will be in bps, no Bps. To determine utilization use this formula: Utilization = ((Total Bytes\Sec * 8)/current bandwidth in bps)*100). During high loads this number may reach saturation thresholds if all other resources are not maxed out. If it does, then bandwidth could be your bottleneck.

EFT Server Counters

 

 

ARM Queue Size

Measures the database inserts currently queued up waiting for SQL (or Oracle)

Less than 10,000 on average on a high load server. An occasional spike in queue size is not necessarily a problem; however sustained high numbers in the hundreds of thousands or a growing queue size could indicate a problem with the database server not having the resources to handle the volume of traffic EFT is throwing its way. Note: If the number is pegged at 1,000, then you may need to apply the advanced property in EFT to override the default max allowed queue size (1,000). Change that number to 500,000 or similar to get a better reading from Perfmon.

Connected Admin Count

Shows the count of currently connected admins.

Less than 10 per server node. A large number of concurrently connected admins could result in performance slowdowns as EFT fights to keep configuration changes from stepping all over each other. Ideally you would have no more than a half-dozen privileged admins or a larger set but that are allocated specific (lesser) admin roles, to avoid conflict.

Workspaces Licenses Used

Measures the number of Workspaces current allocated and not expired. This can be useful for determining whether Workspaces are growing at an unbounded rate by heavy user use of the same.

Less than 100,000 by server node. Once this number grows into the tens or hundreds of thousands, EFT can get bogged down as it attempts to manage these resources, such as routing checking for which ones are expired.

EFT Site Counters

 

 

All

Each counter measures something that can be useful depending on the troubleshooting situation.

No expected values to measure; however keep an eye on AWE actions queue size as a growing queue could indicate that your max allowed AWE objects and threads is set to low (a set of advanced properties), thus resulting in backed up AWE workflows that could slow down EFT if that queue grows too large.

SQL Counters

 

 

Various

Search the web for which counters to measure. Links provided below

If troubleshooting your SQL server (for example, you are trying to determine why EFT’s ARM queue size is growing too large), then there are a number of counters you can run that are specific to the SQL application. Those fall outside the scope of this doc.

Event rule sending duplicate emails in HA environment for User Account Created event

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT, v7.x and later

SYMPTOM

Event rule sending duplicate emails in HA environment

CAUSE

Because each running EFT HA cluster node fires the User Account Created event, and, therefore, runs all User Account Created rules.

RESOLUTION/WORKAROUND

Add an "If Node name" Condition to the Rule.

```

After running Windows 2012 updates, the EFT Admin console hangs and never opens

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT, v7.4.X and later

SYMPTOM

After running Windows updates on Windows 2012, the EFT Admin console hangs and never opens. Any attempt to kill the application (from task manager or by other means) fails.

RESOLUTION/WORKAROUND

  1. Run Windows Update and verify KB4507457 was installed.

  2. If it was not installed, install KB4507457 from Microsoft's website directly: https://www.catalog.update.microsoft.com/Search.aspx?q=KB4507457

  3. Select the Windows Server 2012 R2 variant.

  4. Restart the EFT server service.

MORE INFORMATION

It's very important to install the Microsoft Windows updates when prompted.

Having these updates installed on the system allow the EFT admin console to work properly:

Source Description HotFixID InstalledBy InstalledOn

------ ----------- -------- ----------- -----------

CELES0342012 Security Update KB4506977 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Update KB4507005 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Security Update KB4503308 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Security Update KB4504418 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Update KB4517298 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Security Update KB4512488 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Security Update KB4511872 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Security Update KB4512489 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Security Update KB4503290 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Security Update KB4489883 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Update KB4093753 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Security Update KB4480964 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Security Update KB4487028 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Security Update KB4499165 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Security Update KB4493467 NT AUTHORITY\SYSTEM 8/22/2019 12:00:00 AM

CELES0342012 Update KB4506996 NT AUTHORITY\SYSTEM 8/23/2019 12:00:00 AM

CELES0342012 Security Update KB4483469 NT AUTHORITY\SYSTEM 8/23/2019 12:00:00 AM

CELES0342012 Security Update KB4506962 NT AUTHORITY\SYSTEM 8/23/2019 12:00:00 AM

CELES0342012 Security Update KB4495586 NT AUTHORITY\SYSTEM 8/23/2019 12:00:00 AM

CELES0342012 Security Update KB4507457 NT AUTHORITY\SYSTEM 8/23/2019 12:00:00 AM

What is the difference between FTP, FTPS, and SFTP?

$
0
0

Why would you choose FTPS over FTP, or SFTP over FTPS? Which protocol you should use depends on your network, whether you transfer files outside of your network or allow remote access to your network, and a variety of other variables. Speed and performance are factors, but the most important factor is, of course, security. FTPS is more secure than FTP (which is not secure at all) and SFTP is even more secure than FTPS. Please read the article linked below for very good explanations of the pros and cons and technical limitations of FTP vs. FTPS vs. SFTP.

What is FTPS, FTP, SFTP and what is the difference between them?

The EFT managed file transfer platform supports several different, industry-standard protocols: FTP, FTPS, HTTP, HTTPS, SFTP, AS2, and "FAST" which is a UDP-based protocol.

Read more about EFT here and here.

Can EFT show an “Account locked banner”?

$
0
0

Q. Can EFT show an “Account locked banner” to a user if their authentication failed after multiple invalid login attempts?

A. The short answer is no. EFT is a high-security MFT server often deployed in banking, commercial, and governmental environments with stringent security controls. EFT follows OAWSP best practices by always returning a generic failure message, regardless of the login failure reason. This is to help mitigate account enumeration techniques used by potential attackers.

To improve the user experience of legitimate users who might have simply mistyped their password, you can increase EFT’s default “N” values in the Login Security Options dialog box. Setting a reasonable range would greatly reduce the chance that a valid user would have their account temporarily locked due to invalid login attempts, while ensuring an appropriate outcome upon many repeated failed attempts to gain access by malicious users.

  • The default lockout period is 30 minutes.
  • The default number of invalid (bad password) login attempts is 6.
  • The default period to count the invalid login attempts is 5 minutes.

That is, if you have 6 invalid attempts within a 5 minute period, the account will be locked out for 30 minutes. Or the administrator can unlock it.


Using Edge for CAC authentication displays a 404 Object not found error

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT v8 and later

DISCUSSION

If you are using Edge for CAC authentication, it will display a 404 Object not found error.

By default, EFT does not allow cookies to be sent with cross-site requests, resulting in 404 error.

If you want to use Edge for a browser, you will need to set the HttpCookieSameSitePolicy on EFT to Lax.

To set the HttpCookieSameSitePolicy

HKEY_LOCAL_MACHINE\Software\WOW6432Node\GlobalSCAPE Inc.\EFT Server 7.4\

Type: STRING

Value name: HttpCookieSameSitePolicy

Default Value: Strict; Acceptable values are "Strict","Lax","None". Values other than these will result in "Strict" value.

Cached: yes

Backup/Restore: yes

Customize WTC referrer policy header

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT v8 and later

DISCUSSION

Customize WTC referrer policy header

In the AdvancedProperties.json file, you can add a property to turn off this header or change attributes.

Value name: EnableHTTPReferrerPolicyHeader

Type: bool; true = enabled (default if missing); false = disabled

Value name: HTTPReferrerPolicyAttributeString

Type: string; Admins can enter whatever string they want, including "" (blank). EFT will return whatever string is provided, or empty string if set to "". If missing, then it defaults to "no-referrer";

For example:

{
"EnableHTTPReferrerPolicyHeader": true,
"HTTPReferrerPolicyAttributeString" : "test referrer header"
}

Specify Workspace cleanup frequency

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT v8.0 and later

DISCUSSION

You can specify how often EFT should clean up Workspaces, that is, Workspaces that have expired. By default, they are cleaned up daily.

To specify the cleanup recurrence

Add the following name:value pair to the AdvancedProperties.JSON file: 

Name: WorkspacesCleanupRecurrence

Default Value: 2

Valid Values:

  • 0 = every minute
  • 1 = hourly
  • 2 = daily

For example:

{
"WorkspacesCleanupRecurrence":"1"

Cached: yes

Backup/Restore: yes

Specify the number of days after which to expire a Workspace invitation

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT v8.0 and later

DISCUSSION

You can specify the number of days after which to expire a Workspace invitation.

To the number of days after which to expire a Workspace invitation

Add the name:value pair to the AdvancedProperties.JSON file:

Name: WorkspaceInviteExpirationPeriodDays

Value: 

If not set (default)= 5

If set to 0 = same as Workspace link expiration

For example:

{
"WorkspaceInviteExpirationPeriodDays:"3"

Cached: yes

Backup/Restore: yes

VIEWING INBOUND CONNECTION ENCRYPTION LEVELS

$
0
0

THE INFORMATION IN THIS ARTICLE APPLIES TO:

  • EFT v7.4.9 and earlier (which uses an old SFTP library v1.82_sshlib (Bitvise))
  • EFT v7.4.11 and later with clients that are using older SFTP versions (SFTP library v1.82_sshlib (Bitvise)) EFT v7.4.11 and later use an updated SSH library, v7.7.1.0_openssh. In this case, you will also need to apply the Advanced Property UseLegacySFTP.

DISCUSSION

When it comes to troubleshooting, there are several challenges, including the pressure to meet strict security policies and comply with regulations. These efforts are further complicated by a lack of visibility into how end-users are connecting with your systems. If users are connecting with deprecated or outdated ciphers or algorithms, then problems can occur and your data security could be at risk.

Understand how users are connecting with your EFT platform. Disable deprecated or weaker cryptography whenever possible to help maintain strong system security.

Many EFT customers have asked us if it is possible to gain insight into the SFTP and SSL/TLS cryptography details that their inbound connected clients are using when connecting to EFT. The simple answer is, yes. Having this information is useful not only for troubleshooting, but for proactive/preventive measures as well. To gain this level of visibility into your EFT log files, you will need to enable verbose logging when troubleshooting or debugging.

How To Enable EFT Verbose Logging

Log levels in EFT all default to the TRACE or INFO setting, which is standard or typical logging. If you need more details in your logs, change the logging configuration to extended or verbose log level in logging.cfg to DEBUG. This will give you an extended level of detail in your logs to help you pinpoint where the trouble lies.

For example, with the SSL logging level set to DEBUG, you would see whether the connection was accepted, and which protocol version, cipher, and key length were used in the connection:

DEBUG SSL <> - SSL connection accepted; protocol version = TLSv1.2, cipher = ECDHERSA-AES128-GCM-SHA256, key length = 128

Please note: it is recommended that you only use verbose logging during debugging or troubleshooting. It will produce a large amount of data and quickly use up your processing speed and drive space. It is not necessary to reboot after making these modifications.

Advanced Configuration for Verbose Logging:

Use the following example to set up a separate file appender for verbose logs, which should make data capture and analysis a bit more manageable.

Instead of SFTP = TRACE or SSL = TRACE, specify the following settings in the logging.cfg file:

log4cplus.appender.SFTPFileAppender=log4cplus::RollingFileAppender
log4cplus.appender.SFTPFileAppender.File=${AppDataPath}\EFT-SFTP-${COMPUTERNAME}.log
log4cplus.appender.SFTPFileAppender.MaxFileSize=20MB
log4cplus.appender.SFTPFileAppender.MaxBackupIndex=5
log4cplus.appender.SFTPFileAppender.layout=log4cplus::TTCCLayout
log4cplus.appender.SFTPFileAppender.layout.DateFormat=%m-%d-%y %H:%M:%S,%q
log4cplus.logger.SFTP=TRACE, SFTPFileAppender
log4cplus.additivity.SFTP=false
log4cplus.appender.SFTPFileAppender.filters.1=log4cplus::spi::StringMatchFilter
log4cplus.appender.SFTPFileAppender.filters.1.StringToMatch=Sending SSH_MSG_KEXINIT
log4cplus.appender.SFTPFileAppender.filters.1.AcceptOnMatch=true
log4cplus.appender.SFTPFileAppender.filters.2=log4cplus::spi::StringMatchFilter
log4cplus.appender.SFTPFileAppender.filters.2.StringToMatch=Received SSH_MSG_KEXINIT
log4cplus.appender.SFTPFileAppender.filters.2.AcceptOnMatch=true
log4cplus.appender.SFTPFileAppender.filters.3=log4cplus::spi::StringMatchFilter
log4cplus.appender.SFTPFileAppender.filters.3.StringToMatch=Handling SSH_MSG_USERAUTH_REQUEST for user
log4cplus.appender.SFTPFileAppender.filters.3.AcceptOnMatch=true
log4cplus.appender.SFTPFileAppender.filters.4=log4cplus::spi::DenyAllFilter

After using verbose logging for however long is needed to troubleshoot, copy the EFT-SFTP-*.log files to a new folder for processing. (You have to copy the log files to a separate folder for analysis because the PowerShell cannot open files that EFT is holding open.)

Unzip these PowerShell scripts (specific to this SFTP example) and run the applicable one against those log files in that separate folder to generate a CSV file with the results. Be sure to change the path in the script to the location in which you have created a new folder.

  • ParseLogFilesForSFTPKex_v1.ps1 applies to EFT v7.4.9 and earlier
  • ParseLogFilesForSFTPKex_v2.ps1 applies to EFT v7.4.11 and later with clients that are using older SFTP versions (SFTP library v1.82_sshlib (Bitvise)). You will also need to apply the Advanced Property UseLegacySFTP.

Reminder: Your security efforts will be most effective if you use the latest version of EFT. Periodically check the Globalscape support site for the latest version and upgrade accordingly.

Viewing all 479 articles
Browse latest View live