Remote SFTP Server
A Remote SFTP Server is a type of Endpoint that represents your partner's SFTP server (external). UDMG uses this Endpoint when acting as an SFTP client to connect to your partner's server.
The Endpoint stores connection details such as hostname, port, and authentication credentials, and is used to initiate outbound SFTP transfers. Within a UDMG as Client Pipeline, a Remote SFTP Endpoint can function as either a Source Endpoint (to pull files) or a Destination Endpoint (to push files), enabling secure and automated file exchanges with your partner's SFTP servers.
File transfers when UDMG is acting as the client are only initiated via the Transfer API (not via the UI).
A Pipeline with a Remote SFTP Server Endpoint cannot be associated with an Account or Account Group. The Credentials needed to connect and authenticate with your partner's SFTP server are added on the Pipeline.
Before You Begin
IP or Host Address and Port
The IP or Host Address and Port define the connection to your partner's SFTP Server. Obtain these values directly from your partner.
After configuring the Endpoint, click Validate to confirm that UDMG can successfully connect to the server using the specified IP and port. For detailed steps, see Validating the Configuration.
Domain Forward Proxy
If your UDMG Domain is configured to use a Forward Proxy for outbound connections, decide whether this Endpoint should use the Domain's Forward Proxy settings.
See Forward Proxy for details on configuring Forward Proxy.
Credentials Name (Host Key)
The Credentials Name (Host Key) field references a Public Key Credential containing your partner's SFTP server's SSH host key. During the SSH handshake, UDMG compares this stored key against the one presented by the remote server to verify the server's identity. A mismatch indicates a potential security breach or configuration error, and the connection is rejected.
Only one Public Key can be assigned per Remote SFTP Server Endpoint. There are three ways to obtain this host key:
- Scan for Host Key: Use the built-in Scan for Host Key feature in the Endpoint form to have UDMG retrieve the key directly from your partner's server.
- Provided by the business partner: Ask your partner for their SFTP server host key (in ssh
known_hostsfile format). - Retrieved using external tools: Retrieve it using tools such as
ssh-keyscan. For example, here is how to get the Ed25519 key for the SFTP servertest.rebex.neton port22with thessh-keyscanutility:
- Linux
- Windows (PowerShell)
ssh-keyscan -t ed25519 -p 22 test.rebex.net > rebex.ssh-ed25519
cat rebex.ssh-ed25519
ssh-keyscan.exe -t ed25519 -p 22 test.rebex.net | Out-File -Encoding ascii .\rebex.ssh-ed25519
Get-Content .\rebex.ssh-ed25519
Use the same host identifier that the Endpoint uses and include the port if your environment requires it.
Then, paste the entire host key line (with or without the hostname) into the Key field of the Public Key Credential. For example:
test.rebex.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
After saving, the key definition is populated with the key attributes: algorithm, bits, comment, MD5 fingerprint, SHA256 fingerprint, authorized keys line.
ssh-keyscan retrieves whatever key the server presents over the network. Always verify the key's fingerprint with your partner through a trusted channel before using it in production.
Scan for Host Key
The Scan for Host Key feature lets UDMG retrieve your partner's SSH host key directly, without requiring any manual key exchange or external tools.
Each scan performs a fresh SSH handshake and reports the keys currently presented by the remote SFTP server. The scan does not compare the result against Public Keys existing in UDMG.
To scan the host key, follow these steps:
- In the Endpoint form, enter the IP or Host Address and Port of your partner's SFTP server.
- Click the icon next to the Credentials Name (Host Key) field.
- The Scan for Host Key dialog opens with the Host, Port, and Forward Proxy status shown as read-only values.
- Optionally edit the Preferred Host Key Algorithms field to add, remove, or reorder algorithms. The field is pre-populated with the default algorithm order. The Scan Now button is disabled if this field is left empty.
- Click Scan Now. UDMG connects to the remote server and retrieves the available host keys. The scan can return one of the following results:
- Host Key(s) Matched: One or more host keys were returned. The dialog displays the key details and lets you save the key as a new Public Key Credential.
- No Match: The scan completed but no host keys were returned for any of the requested algorithms.
- Scan Failed: The scan could not connect to or complete a handshake with the remote server.
Host Key(s) Matched
Always verify the fingerprint with your partner before saving. UDMG retrieves the key that the server presents over the network, which may differ from the expected key if the connection is intercepted.
If the scan succeeds:
- The key's algorithm, SHA-256 fingerprint, MD5 fingerprint, and host key value are displayed. Long values are truncated with an ellipsis; the full host key is available via the Copy to Clipboard button (may only function when the UDMG Admin UI is accessed over HTTPS). If the server supports multiple algorithms, one key per algorithm is returned in a carousel. Use the < and > buttons to navigate between keys.
- A Save as Credential Name field appears, pre-populated with a suggested name in the format
{endpoint-name}-{algorithm}-{fingerprint-suffix}(for example,my-partner-ssh-ed25519-Ab1c), wherefingerprint-suffixis the final four hexadecimal characters of the SHA-256 fingerprint. The field updates to reflect the suggested name for the currently displayed key. Edit the name if needed. - Click Save and Assign. Only the currently displayed key is saved. UDMG creates a new Public Key Credential and assigns it to the Endpoint.
You can save the same key multiple times as long as each Credential has a unique name. All credentials created this way are available to view and edit on the Public Keys page.
If the remote server does not support one or more of the requested algorithms, the dialog lists each algorithm that could not be scanned and the reason reported by the server. Any keys retrieved for the remaining algorithms are still displayed and can be saved.
No Match
The scan connected to the remote server without errors, but no host keys were returned for any of the requested algorithms. The dialog shows:
The scan completed but no host keys were returned.
Scan Failed
If the scan cannot reach or complete a handshake with the remote server, the dialog displays the reason. Reported reasons include unreachable host, connection refused, handshake failed, timeout, and no common algorithm. For API errors (such as a missing permission or a server error), the corresponding message is shown instead.
Authentication Credentials at the Pipeline Level
While the Remote SFTP Server Endpoint requires your partner's SSH host key to verify its identity (configured at the Endpoint level), client authentication credentials are configured separately at the Pipeline level. This design allows reusing the same Endpoint with different credentials across multiple Pipelines.
For more information, refer to Remote SFTP Server to Local Filesystem or Local Filesystem to Remote SFTP Server.
Adding an Endpoint
To add an Endpoint, follow these steps:
- From the Sidebar, select Configuration > Endpoints.
- Click the Add Endpoint button.
- Select Remote SFTP Server as the Endpoint Type.
- Complete the Name and Description details for the new Endpoint.
- Enter the IP or Host Address and Port you obtained earlier.
- Assign the host key credential using one of the following methods:
- Scan for Host Key (recommended): Retrieve the key directly from the server. See Scan for Host Key for full steps.
- Manual: Select the Public Key you already created from the Credentials Name (Host Key) dropdown.
- Optionally select ciphers and other algorithms, or use the default. Refer to the table below for guidance.
- Set Enable Endpoint to enable or disable the Endpoint effective immediately.
- Note: The Endpoint must be added to a Pipeline for the Endpoint to be serviceable.
- Click Add.
- Validate the connection (connection only, no authentication). See Validating the Configuration.
Field Descriptions
The following table describes the fields that are configured for the Endpoint:
| Name | Description | Specifications | Required |
|---|---|---|---|
| Endpoint Type | The type of Endpoint indicates the type of file transfer. Select: Remote SFTP Server. | Cannot be modified after creation. | Yes |
| Name | The name of the Endpoint. |
| Yes |
| Description | The description of the Endpoint. | No | |
| Business Service | Assigning a Business Service to this Endpoint restricts updating, deleting, and other actions so only Users with the same Business Service can perform them (role permissions still apply). For details, see Business Services. |
| No |
| IP or Host Address | The IP or host address of the external SFTP server, provided by your partner. | Can be a hostname, IPv4 address, or IPv6 address. | Yes |
| Port | The port number of the external SFTP server, provided by your partner. | Must be within 1 and 65535. | Yes |
| Credentials Name (Host Key) | The name of the Public Key representing the host key from your partner's SFTP server. | Must reference an existing Public Key. | Yes |
| Key Exchange Algorithms | The allowed key exchange algorithms. Options (multi-select):
| Default values:
| No |
| Ciphers | The allowed ciphers. Options (multi-select):
| Default values:
| No |
| MACs | The allowed Message Authentication Codes (MACs). Options (multi-select):
| Default values:
| No |
| Use Forward Proxy | When enabled, the Endpoint uses the Proxy settings defined at the Domain. See Domain Forward Proxy. | Default value: Disabled. | No |
| Enable Endpoint | When enabled, the Endpoint is active and can participate in file transfers. For more information, see Enabling and Disabling an Endpoint. | Default value: Enabled. | No |
Editing an Endpoint
Endpoint configuration changes are pushed to all Pipelines referencing the Endpoint with immediate effect.
To edit an Endpoint, follow these steps:
- From the Sidebar, select Configuration > Endpoints.
- Click the Name field of the Endpoint you want to edit.
- Click the Edit button above the Endpoint details.
- Edit details for the Endpoint, using the Field Descriptions table as a guide.
- Click Update.
Managing an Endpoint
Viewing Endpoint Details
To view the details of an Endpoint, follow these steps:
- From the Sidebar, select Configuration > Endpoints.
- Click the Name of the Endpoint you want to view.
- Additionally, click the Pipelines tab to see all the Pipelines the Endpoint is associated with.
Endpoint Metadata
Endpoint details include all parameters given in the Field Descriptions table above, plus the following read-only metadata:
| Name | Description |
|---|---|
| UUID | The universally unique identifier of this Endpoint. |
| Version | Version number of the latest configuration of the Endpoint. |
| Enabled | Endpoint's Enabled status. Displays Enabled when active, or Disabled when inactive. |
| Created | Date and time this Endpoint was created. |
| Updated | Date and time this Endpoint was last updated. |
| Test Status | Status of the Validate Endpoint configuration test. Options:
|
Validating the Configuration
The Endpoint configuration can be validated to confirm whether an unauthenticated connection with the external SFTP server can be made. After clicking the Validate button, one of the following messages appears:
- Error/Fail: 'Endpoint test has failed. The dial tcp 0.0.0.4:2235: i/o timeout.'
- If validation fails, then the system was not able to make a successful connection with the external SFTP server. Check the Endpoint's configuration, network path, firewall rules, and try again.
- Pass: 'Endpoint has passed the test.'
- If validation passes, then the system was able to make a successful connection with the external SFTP server.
Enabling and Disabling an Endpoint
Remote SFTP Server Endpoints can be Enabled or Disabled to control their active status and ability to participate in file transfers.
- Enabled (default): The Endpoint is active and can participate in file transfers.
- Disabled: The Endpoint is inactive and cannot participate in file transfers.
The status is set during initial creation and can be changed by following these steps:
- From the Sidebar, select Configuration > Endpoints.
- Click the Name of the Endpoint you want to enable or disable.
- Click Edit.
- Move the Enable Endpoint toggle.
- Click Update.
Changes to the Endpoint's Enabled status do not apply to Scheduled Transfers already in progress. The change takes effect on the next Scheduled Transfer.
Deleting an Endpoint
To delete an Endpoint, follow these steps:
- From the Sidebar, select Configuration > Endpoints.
- Click the Name of the Endpoint you want to delete.
- Click the Delete button above the Endpoint details.
- You will be asked to confirm the deletion. Click Continue.
UDMG prevents the deletion of a Configuration Item if it is currently referenced by another Configuration Item (i.e., Pipeline). The Configuration Item must be edited or the reference removed before you can delete the Endpoint. Deletion cannot be undone.