Using MFA for SFTP Proxy

single connect’s built in mfa can be used as an enhanced security level for sftp proxy when users open an sftp client (winscp or filezilla), they are prompted to enter their single connect credentials to connect to the sftp proxy if mfa is activated for sftp proxy for filezilla connections after users log in successfully using their credentials, the following screen opens, where users are asked for an mfa token for winscp connections single connect credentials and mfa token are entered on the same screen also, sftp clients have their own configurations for mfa usage for instance, the logon type should be selected as interactive to enable mfa for a user see figure mfa usage on filezilla below only users in enabled user groups can use mfa for sftp connections to enable mfa use for the user group, please refer to section docid\ u2oncfg32vjondgob1t5r to set up mfa for sftp connections, follow the steps below admin and users must have the qr code, installed the single connect mobile app, scanned the qr code with the mobile app, and mfa must be enabled for the user group that will be using mfa for ssh connections establish an ssh connection to single connect as the pamuser user edit the nsso properties file under /u01/sftp proxy/conf/ directory and add the following configurations in this file nsso connection otp enabled=true nsso otp cache enabled=true nsso otp cache seconds=300 the first command enables mfa the second command sets up otp caching, and the third one sets the cache value to 300 seconds it means that users logging in with otp won't be asked for any token for the next 300 seconds, even if they disconnect and connect again after setting the parameters, restart the sftp proxy by running the following command systemctl restart pam sftp after these settings, users belonging to an mfa enabled user group will be asked for a token on sftp client when logging in to single connect over the 3333 port