Theme
What the Connector is
The Storage Connector is the only part of SFTP.cloud that runs on your own hardware.
It sits next to your storage, holds your files' permissions, and performs the actual reads and writes. Everything else in SFTP.cloud is a service we run for you.
What it does
- Reaches your storage. A disk, a network share, an S3 bucket, an Azure container, a Google Cloud bucket, or another SFTP server.
- Decides what each user may do. Per user, per folder, checked on every single operation.
- Encrypts at rest, if you ask it to. With a key derived from a passphrase that never leaves the machine.
- Keeps a signed record of every operation it performed or refused, which cannot be turned off.
- Runs your automation. Scripts bound to file events.
What it never does
- It never accepts an inbound connection. It dials out to your site. There is no port to open, no public address to assign, no DNS name to register.
- It never sends your files anywhere. Data flows through the tunnel it opened, to the user who asked for it, and nowhere else.
- It never sends its encryption keys anywhere. They exist only on that machine, encrypted under a machine local secret.
- It never trusts your site blindly. Every session your site asks it to open must carry a signed identity record the Connector verifies against a Portal key built into the Connector software itself, obtained at enrollment without your site's involvement. A site that has been taken over cannot mint a user the Connector will accept.
Its own admin console
The Connector has its own web console, on the machine it runs on, at http://localhost:8883 by default.
It is deliberately not cloud reachable
The Connector's admin console is never exposed to the internet by SFTP.cloud, and there is no setting that makes it so. If you need to reach it from another machine, you bind it to a network address and put TLS on it yourself. See Settings.
The console has its own local administrator accounts, with mandatory two step sign in. They are separate from your Portal team, they work offline, and Syncplify has no access to them.
What is configured where
This is the split people trip over, so it is stated twice on this site.
| Decision | Where |
|---|---|
| Which users exist | The Portal, on Users |
| How a user signs in | The Portal |
| Which storage a user's session shows, and at which paths | The Portal |
| What storage exists at all | The Connector, on Virtual file systems |
| What a user may do inside a folder | The Connector, on Permissions |
| Encryption at rest | The Connector |
| File automation | The Connector |
A user created in the Portal appears on the Connector automatically. Until somebody grants them access there, they can sign in and every folder stays closed.
What it needs
- A Windows or Linux machine that can reach your storage. It does not need to be powerful.
- Outbound network access. No inbound.
- Somewhere to keep its own data directory: its database, its identity and its logs.
Full detail: Before you install.