---
title: Managerial Approval for SFTP Devices Connections
slug: kronpam-reference-guide-3-9-0/managerial-approval-for-sftp-devices-connections
description: Learn how to obtain managerial approval for device connections by setting the "approvalRequiredForConnection" property to true. Find out how to prevent multiple approval emails for repetitive attempts and set a time limit for sending approval emails.
docTags: 
createdAt: 2022-08-01T18:10:53.000Z
---

To enable managerial approval via e-mail or mobile notification for users connecting to devices, the **Require Managerial Approval** property must be set on the device group that has the target devices.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/mKiPoCWTlnEd1TAb6QAm6_image.png" size="86" width="754" height="148" position="center" caption="Approval Required property" showCaption="true"}

When the managerial approval property for the user is set, an approval request e-mail is sent to the group manager of the user who attempted to establish the connection. For each attempt, a new approval request email is generated and sent to the manager’s email address. 


A parameter can be configured to set a time limit on sending emails for the same connection request:

1. Establish an SSH connection to the Kron PAM server.
2. Set the required parameter in **/pam/sftp/conf/nsso.properties** with the commands:
   `cd /pam/sftp/conf/
   `
   `vi nsso.properties
   `
   Add/edit the following parameter with the vi editor:
   **nsso.approval.email.timeout = 0** (default value is “0” and the label of the value is seconds.)
3. After the parameters are set, save, and exit the vi editor, and restart sftp\_prox with the command:
   `systemctl restart pam-sftp.service`

The parameter prevents Kron PAM from sending too many emails to the manager for each repetitive attempt. For example, if this parameter is set to 300 seconds, and a user attempts to connect to a device more than one time in five minutes, only one connection approval request email is sent to the manager. To receive a connection approval request email for each attempt separately, the parameter’s default value of zero can be used.