SFTP Proxy Transfer Performance Settings
File transfers through the SFTP Proxy can be slower than direct transfers to the device. Two independent factors cause this:
· Network latency between the SFTP Proxy and the device: By default, the SFTP Proxy sends one read request at a time and waits for the reply before it sends the next one. When the round-trip time (RTT) is high, for example on a wide area network (WAN), the transfer speed drops sharply.
· CPU load caused by encryption: By default, the SFTP Proxy runs SSH encryption in software and doesn’t use the hardware AES instructions of the CPU. When the device is on the same local area network (LAN) as the SFTP Proxy, the CPU limits the transfer speed.
You can use two parameters to improve the transfer speed. Both parameters are disabled by default. If you don’t enable them, the SFTP Proxy behavior doesn’t change.
Table a: SFTP Proxy Performance Parameters
Parameter | Description |
|---|---|
nsso.sftp.transfer.optimize.enabled | Improves the transfer speed on high-latency connections. When you set it to true, the SFTP Proxy does the following: sends multiple read requests to the device at the same time during downloads (read-ahead); sends multiple write requests without waiting for each reply during uploads (write-behind); enables TCP_NODELAY on both SSH connections (user to SFTP Proxy, and SFTP Proxy to device); and processes audit information once per file instead of once per data packet. The default value is false. |
nsso.sftp.crypto.optimize.enabled | Improves the transfer speed when the CPU limits performance, typically when the device is on the same LAN as the SFTP Proxy. When you set it to true, the SFTP Proxy does the following: uses the built-in Java Virtual Machine (JVM) cryptographic provider for SSH encryption and message authentication code (MAC) operations, so it can use the AES instructions of the CPU (AES-NI); and prefers AES-GCM instead of ChaCha20-Poly1305 on the connection between the SFTP Proxy and the device. The default value is false. |
Use the RTT between the SFTP Proxy and the device to decide which parameter has the most effect:
Table b: Recommended Parameters by Round-Trip Time
RTT (SFTP Proxy to Device) | Main Limiting Factor | Recommended Parameter |
|---|---|---|
Less than 1 ms (same LAN or data center) | CPU | nsso.sftp.crypto.optimize.enabled |
1–10 ms | Both | Both parameters |
More than 10 ms (WAN) | Network latency | nsso.sftp.transfer.optimize.enabled |
To enable the SFTP Proxy transfer performance settings:
1. Connect to the Kron PAM server CLI as an admin user.
2. Open the /pam/sftp/conf/nsso.properties file and add the following lines:
nsso.sftp.transfer.optimize.enabled=true nsso.sftp.crypto.optimize.enabled=true
3. Restart the SFTP Proxy service with the following command:
systemctl restart pam-sftp.service
1. Check the /pam/sftp/log/application.log file to make sure the following lines appear:
[TCP_NODELAY] enabled on both the server and the client side [CIPHER_PREFER_JCE] using the JVM provider for: [...] [CIPHER_PREFER_GCM] client-side cipher order is now: [email protected], ...
When you enable nsso.sftp.crypto.optimize.enabled, the encryption algorithm used between the SFTP Proxy and the device changes from ChaCha20-Poly1305 to AES-256-GCM. Both algorithms use 256-bit keys, and AES-GCM is approved by the Federal Information Processing Standards (FIPS). The list of algorithms that the SFTP Proxy offers to clients doesn’t change.
If a device doesn’t work correctly after you enable nsso.sftp.transfer.optimize.enabled, disable this parameter and use only nsso.sftp.crypto.optimize.enabled. On high-latency connections, this parameter alone doesn’t fully solve slow transfer speeds.
To measure the effect of these settings, transfer a file of at least 200 MB before and after you enable the parameters. Repeat each measurement at least three times.
To disable the settings, remove the lines or set the values to false, and then restart the SFTP Proxy service.