THE INFORMATION IN THIS ARTICLE APPLIES TO:
SYMPTOM
After installing a CUCM v9.1 patch, it no longer communicates with the SFTP server.
RESOLUTION
According to Cisco support, "This arises due to a fix implemented with CSCtc49288." https://tools.cisco.com/bugsearch/bug/CSCul38509
Upgrade to ES 9.1.2.12024-1 or later to resolve the issue. https://supportforums.cisco.com/discussion/11823606/cucm-86-backup-sftp-timeout-issue
THE INFORMATION IN THIS ARTICLE APPLIES TO:
SYMPTOM
When running the AS2 Outbound Settings test with a DMZ proxy defined, if the proxy goes offline, the EFT administration interface times out with the message "A connection timeout occurred while waiting for the Server to reply."
RESOLUTION
Restart the server service on all nodes.
THE INFORMATION IN THIS ARTICLE APPLIES TO:
DISCUSSION
Some organizations require that file transfers are restricted to FIPS-approved algorithms. The library used by our OpenPGP module is not restricted to only FIPS-compliant cryptography. However, you can add a registry setting to EFT to restricts the OpenPGP module to use only FIPS-compliant cryptography that is available in the library.
The registry setting described below, when present and the DWORD value is set to non-zero, will configure the OpenPGP library to use FIPS-compliant cryptography only.
To enable FIPS-compliant mode for the OpenPGP module
32-bit OS:
[HKEY_LOCAL_MACHINE\SOFTWARE\GlobalSCAPE Inc.\EFT Server 4.0\Config\]
64-bit OS:
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GlobalSCAPE Inc.\EFT Server 4.0\Config\]
DWORD: OpenPGPFIPSCompliantAlgorithmsOnly
The table below lists the algorithms available for each mode.
FIPS compliant mode | Non-FIPS mode |
=Symmetric Encryption Algorithms= | =Symmetric Encryption Algorithms= |
=Hash Algorithms= | =Hash Algorithms= |
=Asymmetric Algorithms= | =Asymmetric Algorithms= |
=Compression Algorithms= | =Compression Algorithms= |
THE INFORMATION IN THIS ARTICLE APPLIES TO:
DISCUSSION
EFT Server stores its configuration information in the Windows Registry, which contains profiles for each user of the computer and information about system hardware, installed programs, and property settings. EFT Server modifies the system registry as needed, and continually references this information during operation.
To add a key to the registry, you can either edit it directly or create and execute a .reg file. When you add or edit these registry keys, you will need to restart EFT Server.
 | These options are for advanced users only. Incorrectly editing the registry can severely damage your system. You should always back up (export a copy of) the registry before you make any changes to it. Some paths are HKEY_LOCAL_MACHINE\SOFTWARE\GlobalSCAPE Inc.\EFT Server 3.0\, and others are HKEY_LOCAL_MACHINE\SOFTWARE\GlobalSCAPE Inc.\EFT Server 4.0\. Do NOT change the path to match your version of EFT Server. |
The registry keys described at the links below are available in EFT Server for advanced system administration.
The instructions below are provided only as a reminder for advanced users.
If you are not experienced with editing the Registry, please ask your system or network administrator for assistance.
To backup the registry
If you are exporting the entire registry, it can take a few minutes, and the file size can be up to 100 MB or more. If you are exporting just one key, the file size is approximately 1 KB.
To create a .reg file
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\GlobalSCAPE Inc.\EFT Server 4.0\EventRules]
(include brackets)
"FolderMonitorWorkerThreadCount"=dword:00000100
(include quotation marks)
threadcount.reg
To create the key manually
| Some of the keys should be created in the EFT Server 3.0 folder, and some should be created in the EFT Server 4.0 folder. Do NOT change the path to match your version of EFT Server. |
THE INFORMATION IN THIS ARTICLE APPLIES TO:
SYMPTOM
Unable to rename or delete Usr, Bin, Incoming, or Pub folders through the VFS manager in the administration interface.
You can delete the Bin, Incoming, and Pub folders in the Windows file system if you have no use for them. The Usr folder is where your users' folders are stored.
RESOLUTION
EFT does not allow removal or renaming of special folders in the administration interface, because user folders are saved in these reserved paths.
THE INFORMATION IN THIS ARTICLE APPLIES TO:
(no changes to COM were made for 6.4.10)
DISCUSSION
The attached spreadsheet lists which of the interfaces, properties, methods, and enums in the COM API were added or modified. Use this reference to guide you when you upgrade EFT Server to verify your scripts and make changes, if any. Refer to the COM API Reference for details of the changes:
http://help.globalscape.com/help/gs_com_api/index.htm.
THE INFORMATION IN THIS ARTICLE APPLIES TO:
SUPPORTED PRODUCTS
Technical support is provided in accordance with the GlobalSCAPE End of Life (EOL) and Support Life Policy. The following products are supported to the extent specified. Products not listed are no longer supported.
FULL SUPPORT (Provided from the time of GA release until the End of Life or EOL2 date.)
FULL SUPPORT (Wind-down Period1) (During the Wind-down Period, for Cases that are not Severity One Issues, GlobalSCAPE will typically either (i) provide an existing Bug Fix, (ii) address the issue through a regularly scheduled Maintenance Release to the current Major Release of the Licensed Software product for which EOL has not occurred, or (iii) delay resolution and determine whether it will address the issue in its normal development of future Releases. The Wind-down Period extends 6 months maximum after EOL2.)
PARTIAL SUPPORT (With Partial Support, our technical support engineers provide customers with known Bug Fixes, existing Maintenance Releases, or access to online self-help resources in response to requests for assistance. Partial Support will be subject to the availability of resources and may be limited as GlobalSCAPE determines in its sole discretion. The Partial Support period extends 12 months after GA Date4 or 6 months after wind-down period, whichever is greater.)
For more information about Support Levels or Support Periods, please browse to the GlobalSCAPE End of Life (EOL) and Support Life Policy.
1 The Wind-down Period is the period (6-months maximum) immediately following End of Life, or EOL.
2 End of Life, or EOL, for any Major Release and its Maintenance Releases shall be the date of the release of the subsequent Major Release.
3 Or earlier in the case of an expedited Wind-down Period which is defined in the GlobalSCAPE End of Life and Support Life Policy.
4 The GA Date is the date when a new Major Release is made generally available commercially.
5End of Support Life, or EOSL, means when GlobalSCAPE ceases providing Full or Partial Support for a particular Licensed Software product.
THE INFORMATION IN THIS ARTICLE APPLIES TO:
QUESTION
How do I archive historical data from ARM in a manner that allows access to reports and visibility of the archived data?
ANSWER
A database utility (DButility.exe) is included as part of the EFT installation. The "PURGE" option can be used to trim data with a historical database to include data for a specific period.
The instructions below explain how to:
Assumptions
Create ARCHIVED database copies
Copy and Edit Report Connection Strings
Now that you have individual databases containing historic ARM data by year, you can create reports to match. From within the VSReport Designer, copy and edit the connection string for each report needed to query archived data.
provider=SQLNCLI10;server=mysqlserver;database=ARM-ArchiveDB2012;UID=armadmin;Pwd=xxxxx;
This process can be adapted to cover shorter or longer time spans. Archives can be created monthly, quarterly, and yearly, as needed.
Example Strategy by Data Age
Suppose your business must retain 1 year of transactional EFT data within the production ARM and must retain all transactional data in archive for an additional 4 years. After the data ages to 5 years, the database can be purged or deleted. This can be achieved by creating an ARM database for each year.
With ARM data segregated by year in unique databases you have the following storage options:
Example Strategy by Database Size
Determine an optimal SQL database size based on the volume of your transactional data and SQL Server resources. For this example, suppose the business has determined that 100 GB is the optimal size. Create two copies of the current production database.
MORE INFORMATION
Refer to the following online help and knowledgebase articles for more information:
THE INFORMATION IN THIS ARTICLE APPLIES TO:
SYMPTOM
Unable to upload a photo to Facebook.
RESOLUTION
Now you should be able to upload photos without errors. You can also create new albums from withing TappIn.
THE INFORMATION IN THIS ARTICLE APPLIES TO:
QUESTION
How Do I Automate Outbound AS400 Data Feeds?
ANSWER
Suppose a business needs to transfer sensitive data to external trading partners. The data is stored internally and processed by an AS400. The AS400 outputs a data file that must be sent to the proper external trading partner using a secure protocol. The AS400 will connect to the Globalscape EFT server, but will have no exposure to the Internet or external client sites.
Requirements
Assumptions
EFT Environment
Solution Overview
We want to ensure that files are delivered to the correct external trading partner and will be uploaded into the correct external folder. This solution uses the File Uploaded Event with three Conditions to invoke an Event Rule. The file will be uploaded by the AS400 EFT user account to a specific virtual folder, and must match a filename mask.
The combination creates a process that prevents files from accidently being sent to the wrong location by the wrong user or process. This process can be edited to use the If user is a member of a group Condition to replace the If Login Name Is Condition. Physical folders can be used for the If Virtual Folder Names does match Condition. However, virtual folders provide more flexibility. This scenario is not required, but provides a good foundation for building logical filters to trigger events. You can simply apply Events and Conditions that match your requirements and use as many or few as needed.
EFT account for AS400 - Establish the primary upload account that will be configured on the AS400’s SFTP session to the EFT platform. In this case, the account name is AS400. If you have many AS400’s sending files to EFT, this rule can be configured using a list of accounts or a group of users. Each account needs to have access to the outbound folders, so you may want to use virtual folders. Additionally, it is always best practice to use key-based authentication with service accounts.
“Outbound” folder structure – To define the virtual folder name, create an outbound folder system that can be accessed by the AS400 user account. As new Event Rules are added to the site, the folder you create will be populated with unique folders for each outbound feed. The AS400 will need to upload files into the proper outbound client subfolder.
MORE INFORMATION
Refer to the attached PDF for details of how to build the Event Rule.
THE INFORMATION IN THIS ARTICLE APPLIES TO:
SYMPTOM
"## NO DATA ##" is displayed in the BAM transactions list.
RESOLUTION
Contact Support or your account manager to get the latest version of BAM. Versions of BAM prior to version 3.5 do not function properly with EFT version 7.0.0.
MORE INFORMATION
THE INFORMATION IN THIS ARTICLE APPLIES TO:
QUESTION
How can I set the Web Transfer Client (WTC) to default to the HTML5 version instead of the Java-enabled version?
ANSWER
The EFT administrator can edit a file in the EFT installation folder to make the HTML5 version of the WTC the default login (the Java-enabled version check box would be cleared by default), or remove the check box altogether.
| Instead of making changes to files in the \web\public\EFTClient\ folder, copy and paste the \EFTClient\ folder into the \web\custom\ folder. Then only make changes to files in the \web\custom\EFTClient\ folder. |
To make the HTML5 version the default
If you want to make the HTML5 version of the WTC the default, but still allow end users to choose the Java-enabled version, you can clear the check box using the procedure below.
C:\Program Files (x86)\Globalscape\EFT Server Enterprise\web\custom\EFTClient\Account\
(You will have to create the \EFTClient\ and \Account\ folders if you haven't already.)
{{#CLIENT_CHECKBOX_SECTION}} and {{/CLIENT_CHECKBOX_SECTION}}, remove the following code: checked="true"
(Make sure there is only one space left, not two.)
The checkbox will no longer be selected and the HTML5 version of the WTC will appear after login.
To remove the "Use Java enabled version" check box
You might not want end users to be able to select the Java-enabled version of the WTC. In that case, you can remove the check box and text using the procedure below.
C:\Program Files (x86)\Globalscape\EFT Server Enterprise\web\custom\EFTClient\Account\
(You will have to create the \EFTClient\ and \Account\ folders if you haven't already.)
{{#CLIENT_CHECKBOX_SECTION}} to {{/CLIENT_CHECKBOX_SECTION}}. The checkbox and text will no longer be displayed and the HTML5 version of the WTC will appear after login.
To restore the "Use Java enabled version" check box
Note that any customizations you make to the WTC will have to be recreated when you upgrade.
THE INFORMATION IN THIS ARTICLE APPLIES TO:
SYMPTOM
The server issued one or more cookies that did not have the HttpOnly flag set.
RESOLUTION
The server designates all cookies as HttpOnly where applicable; however, EFT Server’s design requires that a certain number of its cookies be accessible by EFT Server’s client side JavaScript; therefore, those cookies do NOT have the HttpOnly flag set.
You should also note that setting the HttpOnly flag does not guarantee that a cookie cannot be read by an attacker. Researchers have found at least one method to beat the HttpOnly flag using a technique called Cross Site Tracing (XST), which exploits the HTTP TRACE method. The good news is that EFT Server’s HTTP engine does not support the TRACE method, thus rendering that particular attack vector nil (at least for those cookies protected by the HTTPOnly flag).
MORE INFORMATION
The purpose of the HttpOnly flag is to signify to the browser to not allow Javascript to access a particular cookie that contains sensitive information. Most commonly this is seen for a session cookie, because gaining this value will allow impersonating the user. Mail Express already uses the HttpOnly flag for the session cookie. Additional cookies are used; however, they don’t contain sensitive information, just items to improve user experience. Also note that the HttpOnly flag does not guarantee that a cookie cannot be read by an attacker. Researchers have found attack vectors that can exploit it.
Cookies that do not have the HttpOnly flag set can be read by JavaScript. Should an XSS vulnerability exist on the site, an attacker could use JavaScript to read the session cookie and subsequently impersonate the user. The server administrator should continue to educate users on phishing and other scams that may result in an XSS type of attack. Prevention is the best cure in this case.
THE INFORMATION IN THIS ARTICLE APPLIES TO:
DISCUSSION
In a standard installation, the Mail Express Outlook Add-In interface is initially hidden from the user. This is intended to accommodate those users who may not react well to even the slightest change. However, many users appreciate the added productivity when fully leveraging Mail Express, which requires some use of the simple and intuitive Mail Express user interface. While choosing to display the Mail Express user interface is quick and easy, some organizations may prefer to deploy the Mail Express Outlook Add-In with the user interface already enabled in order to save their users that step and avoid any questions on how to do so.
The setting that governs whether or not the interface is visible is specific to each user’s local installation of the Mail Express Outlook Add-In. It is stored as the PrimaryToolbarVisible parameter of the file %AppData%\Globalscape\Mail Express Outlook Addin\settings.config and is changed automatically when a user chooses to show or hide the interface. When deploying the Mail Express Outlook Add-In to user workstations (using your preferred deployment utility), you may choose to add a step to the process after successful installation to perform one of the two following actions while Outlook is closed:
OR
There are other parameters in the settings.config file that you may also find interesting to define for users based on their anticipated preferences, such as the ReceiveDownloadNotifications parameter that controls whether the sending user is notified via email when a recipient of a package sent through Mail Express has retrieved a file from that package, defined in the user interface’s Default Send Options tab and selectable for each message with attachments managed by Mail Express.
To familiarize yourself with the contents of this file and to test performing this change manually, can follow the steps below on a system with the Mail Express Outlook Add-In installed:
THE INFORMATION IN THIS ARTICLE APPLIES TO:
SYMPTOM
Multiple simultaneous Advanced Workflow Engine (AWE) Tasks affect system performance
RESOLUTION
Adjust the maximum number of simultaneous tasks that are allowed to run and the number of simultaneous Advanced Workflow engines that can process the tasks.
Please contact GlobalSCAPE Technical Support for guidance before adjusting these settings.
The following registry DWORD values affect the processing of AWE tasks:
The values are RunningTaskLimit and GSAWEObjectsPerServerInstance.
Given the default values, only 3 tasks will run in a single instance of the AWE engine at a time, even if more are called for.
Below is a table showing various outcomes assuming a Folder Monitor operation where 100 files are deposited:
Running Task Limit | GSAWE Objects PerServer Instance | Number of AWE Engine instances | System Affect (mem, CPU) | Efficiency | Risk of failure due to threading | Explanation and Pros/Cons. |
3 (default prior to v7) | 20 (default prior to v7) | 1 | Very low | Low | Low | A single AWE engine instance processes 3 tasks at a time. Low impact on resource but takes longer to process all 100 tasks. |
| In EFT v7 and later, the default is 10 | In EFT v7 and later, the default is 1 | 1 | Low | Low | Low | EFT will run 10 AWE tasks concurrently, each in their own GSAWE.exe engine |
20 | 20 | 1 | Low- | Medium | Medium | A single AWE engine instances processes 20 tasks at a time. Moderate impact but processes faster. Slightly increased risk of failure due to threading issues. |
40 | 20 | 2 | Med | Med- | Med- | Two AWE engine instances processes 40 tasks concurrently (20 each). Higher impact and 2X memory utilization for GSAWE (engine) process. |
100 | 100 | 1 | Med | High | High | Single AWE engine instance processes all 100 tasks concurrently. Only moderate performance hit but highly efficient processing. Downside is increased risk of failure due to AWE engine threading issues. |
100 | 20 | 5 | Med- | High | Med- | Five AWE engine instances processes 20 tasks each concurrently. Increased impact to resources, great performance, low-moderate risk of threading issues. |
20 | 1 | 20 | High | Med | Zero | Twenty AWE engine instances processes a single task each. Significant impact to resources and memory utilization, moderate performance, zero risk of threading issues. |
100 | 1 | 100 | Very | Very | Zero | Eliminates threading related problems by executing one AWE engine instance for each task. Problem is memory consumption for the up to 100 AWE engine instances. RAM upgrade may be in order. |
So which value should you choose? It largely depends on what you are trying to accomplish and system resources available. Setting values of 50:50 (or 100:100) is highly efficient in terms of executing multiple tasks simultaneously with minimal impact to system resources, but there is an increased risk of failure due to the various task threads exiting completed tasks when other tasks are still being processed or haven’t yet started. If you have the system resources (RAM/CPU), then you may want to set a 10:1 or 20:1 (or higher) for a RunningTaskLimit:GSAWEObjectsPerServerInstance ratio. The result will be processing of many tasks concurrently, but with each task requiring a new AWE engine instance – fast but very resource intensive.
NOTES:
THE INFORMATION IN THIS ARTICLE APPLIES TO:
QUESTION
How do I clear the Java certificate store of Globalscape certificates?
ANSWER
Globalscape certificates are obtained during the use of Java-enabled applets within Globalscape software.
To clear the Java certificate in Windows
For Mac OS, follow the instructions at this link:https://elearn.usu.edu/java/clearing-certificates.html
THE INFORMATION IN THIS ARTICLE APPLIES TO:
DISCUSSION
By default, if the Web Transfer client (WTC) (or, in v6.3 and later, the Plain Text Client (PTC)) is idle for 5 minutes, the session is released. That is, if no activity occurs during this time frame, the session is closed. This time out is for security purposes and, for the WTC, so that others can use one of the concurrent licenses. You may want the time to be longer or shorter, depending upon expected usage.
You can control this timeout in the Windows registry on the EFT Server computer by creating a new DWORD value that indicates the number of minutes that you want the session to be active, but idle, before the session is released.
On 32-bit systems:
HKEY_LOCAL_MACHINE\SOFTWARE\GlobalSCAPE Inc.\EFT Server 3.0\
On 64-bit systems:
HKEY_LOCAL_MACHINE\Software\Wow6432Node\GlobalSCAPE Inc.\EFT Server 3.0\
Create the DWORD WTCTimeout and set the value to the number of minutes that a session can remain idle before it is released. The default value is 5 minutes (00000005).
Restart the server service for the change to take effect.
THE INFORMATION IN THIS ARTICLE APPLIES TO:
QUESTION
Which Data Loss Prevention (DLP) or Anti-virus (AV) solutions does EFT work with?
ANSWER
EFT Enterprise v7 and later has a "Content Integrity Control" feature, which is part of the Event Rule subsystem. Content Integrity Control allows event workflows to hand files off to a third-party content analysis tool and react according to the results of that analysis. DLP and antivirus/antimalware are common use cases.
The underlying technology used to integrate EFT with third-party analysis tools is ICAP, which is an industry standard protocol. Numerous DLP vendors support this natively, making integration with EFT a breeze. WebSense, Symantec (formerly Vontu), IBM Fidelis, RSA DLP, CodeGreen Networks, and others each support ICAP, and a number of them have been fully tested with EFT.
Although Globalscape cannot endorse a particular vendor or product, we can state that, based on EFT customer feedback, it appears that WebSense and Symantec are very capable and widely used DLP solutions.
Please contact your account representative to demonstrate EFT's capabilities, and further discuss your company's AV or DLP project.
THE INFORMATION IN THIS ARTICLE APPLIES TO:
DISCUSSION
The "POODLE Vulnerability" (CVE-2014-3566) is a serious vulnerability in the popular OpenSSL cryptographic software library (through version 1.0.1i). This weakness allows stealing the information protected, under normal conditions, by the SSL encryption used to provide communication security and privacy over the Internet for applications such as web, email, instant messaging (IM), and some virtual private networks (VPNs).
EFT supports SSL connections for HTTPS and FTPS. For broad client support and backward compatibility, SSLv3 can be enabled on EFT. The SSLv3 protocol is vulnerable to the POODLE exploit. It is highly recommended, therefore, that you verify and modify the SSL configuration of EFT as needed to protect your information assets.
WORKAROUND
THE INFORMATION IN THIS ARTICLE APPLIES TO:
DISCUSSION
On NTAD/LDAP Sites, you can configure EFT Server through a registry key setting to send an e-mail notifying users that their password is about to expire in <n> days. Without this value, EFT Server (for AD/LDAP Sites) will not attempt to check password status or send notification e-mails. If the user's password expiration date matches any of the list of days in the registry key, a notification e-mail will be sent to the user’s e-mail address specified in the E-Mailaddress field of the user's AD account. This default setting sends e-mail notifications 30 days, 15 days, 10 days, 5 days, and 1 day before the password expires. You can edit the number of days and frequency to send notifications.
| EFT Server executes cleanup procedures every day at 00:00:00 UTC and at Server Startup. This daily server cleanup removes/disables inactive administrators and user accounts and sends password reset and expiration notifications for every Site. |
| The EFT Server must have "Log On as a domain user" permission for e-mail notifications to work. |
In the Client directory of the Server installation folder, the file PasswordChg_EmailInterval.reg provides a script to write the following key to the registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\GlobalSCAPE Inc.\EFT Server 4.0\EFTClient]
"PasswordChg_EmailInterval"="30:15:10:5:1"
(On a 64-bit OS, use the path [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GlobalSCAPE Inc.\EFT Server 4.0\EFTClient])
The string value is in the format of d1:d2:d3 etc. For example, the 30, 15, 10, 5, 1 interval values will be represented by 30:15:10:5:1.It can also be a single value, such as 25, which would send only one e-mail notification on the 25th day before expiration. If the string value is empty, no notifications are sent.
This feature can be turned off by running the PasswordChg_EmailInterval_None.reg script or setting the value of PasswordChg_EmailInterval to null (empty string). When the feature is turned off, notification e-mails are no longer sent to users when their passwords expire. (Both scripts are installed in the \Clientdirectory).
When the password has expired or if the password must be changed at the first login, the following message appears:
Your password has expired. Please create a new password that meets AD complexity requirements.
As of version 6.1, EFT Server sends the message and logs the password checking activity, including whether e-mails are sent.
See also Changing an AD Password via the Web Transfer Client in your version of the EFT Server documentation.