---
title: Using MFA for SFTP Proxy
slug: singleconnect-reference-guide-3-1-0/using-mfa-for-sftp-proxy
description: Learn how to implement Multi-Factor Authentication (MFA) for SFTP Proxy with this comprehensive document. Find out how users are prompted for Single Connect credentials and required to enter an MFA token for enhanced security. Discover the configuration s
docTags: 
createdAt: 2022-08-01T10:06:08.000Z
---

Single Connect’s built-in MFA can be used as an enhanced security level for SFTP Proxy.


When users open an SFTP Client (WinSCP or FileZilla), they are prompted to enter their Single Connect credentials to connect to the SFTP Proxy. 


If MFA is activated for SFTP Proxy:

-
  **For FileZilla connections**: After users log in successfully using their credentials, the following screen opens, where users are asked for an MFA token. 
-
  **For WinSCP connections**: Single Connect credentials and MFA token are entered on the same screen. 

Also, SFTP clients have their own configurations for MFA usage. For instance, the logon type should be selected as **interactive **to enable MFA for a user. See Figure - MFA Usage on FileZilla below. 

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/4_zjK1_4VwwhvDXQHXm5I_image.png" size="70" width="824" height="233" caption="MFA Usage on FileZilla" position="center" showCaption="true"}



::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/dtX_JGVuAS11_h83tk-Ji_image.png" size="70" width="828" height="397" caption="MFA Usage on WinSCP" position="center" showCaption="true"}

Only users in enabled User Groups can use MFA for SFTP connections. To enable MFA use for the user group, please refer to section [](https://app.archbee.com/docs/jsymInd0w_SXayMlKGOmR/JUE7JvWWHhJ0z8r4O67NR)[Enabling One-Time Password (OTP)](docId:_sNgOzT0ejJo6neXHr8JQ). 


To set up MFA for SFTP connections, follow the steps below:


:::hint{type="info"}
Admin and users must have the QR code, installed the Single Connect mobile app, scanned the QR code with the mobile app, and OTP must be enabled for the user group that will be using MFA for SSH connections. (See sections [Sending MFA QR Code to Users](docId\:rp1Jmk8eURGPhf9kk1Ptd), [Creating a Connection Between Single Connect and the Single Connect Mobile Application](docId\:KccA5BSNGQRWE6HGWriWQ), [Enabling One-Time Password (OTP)](docId:_sNgOzT0ejJo6neXHr8JQ))

 [](https://app.archbee.com/docs/jsymInd0w_SXayMlKGOmR/rTcZ2lmPnnQ5CvCC0C0qE)
:::

1. Establish an SSH connection to Single Connect as the **pamuser** user.
2. Edit the “**nsso.properties**” file under /u01/sftp-proxy/conf/ directory and add the following configurations in this file.

**nsso.connection.otp.enabled=true
**
**nsso.otp.cache.enabled=true
**
**nsso.otp.cache.seconds=300**

The first command enables OTP. The second command sets up OTP caching, and the third one sets the cache value to 300 seconds. It means that users logging in with OTP won't be asked for any token for the next 300 seconds, even if they disconnect and connect again.

- After setting the parameters, restart the sftp proxy by running the following command:

**systemctl restart pam-sftp**

****