MFT Connection Profile Parameters

The following table describes MFT connection profile parameters.

Parameter

Description

MFT connection profile type

Determines one of the following connection profile types:

  • File transfer single endpoint: Transfers files from the host defined in this connection profile to hosts defined in multiple connection profiles. Select this option if you want to reuse this connection profile to transfer files to different hosts.
  • File transfer dual endpoint: Transfers files between two specific hosts defined in this connection profile.
  • File Transfer group: Transfers a file from one host to multiple hosts in one transfer.

Connect to

Transfers files using one of the following protocols:

Host Name

Defines the name of the host computer

Port

Determines the port used to communicate for each host.

Defaults:

FTP: 21

SFTP: 22

OS Type

Determines which platform the host resides.

If you want to connect with SFTP to a USS file system on Mainframe, you must select UNIX.

If you want to connect with SFTP to a z/OS file system on Mainframe (via Co:Z), you must select MVS.

User Name

Defines the username of each host.

If it is a local host on Windows, the domain name must be specified. If it is a remote host on Windows, the domain name might need to be specified if required by the server.

Password

Defines the password for each user connection profile

Home Directory

Determines the home directory for each host that appears in the File Selection dialog box in the Control-M MFT properties pane.

Control-M MFT supports both Name Format 0 and Name Format 1. The syntax of the home directory determines which format is used (OS/400 platforms only).

To retrieve the home directory from the remote server or local computer, click Get Home Directory (This feature is not available for Unisys OS2200).

Manual Additional Parameters

Enables you to add parameters for futher connection profile configuration, as described in Connection Profile Manual Additional Parameters

FTP Protocol Parameters

The following table lists the FTP protocol parameters.

Parameter

Description

FTP Connection Modes

Determines one of the following connection modes for FTP:

  • FTP Passive (PASV): Initiates the data and control connections from the FTP client to the FTP server, which solves firewall issues.
  • Extended Passive (EPSV): Determines whether to use the Extended Passive Mode, where the FTP client uses the same IP address to open a data channel. This is mainly used for IPV6 environments..
  • Active: Initiates the data channel from the FTP server to the FTP client random port. This mode can encounter issues when the server attempts to open the data channel, due to Firewall rules. BMC recommends that you choose a passive mode.

Substitute IP address

Forces passive connections to use the host address.

FTP over SSL/TLS (FTPS)

Defines the communication protocol as FTP over SSL/TLS

SSL Implicit

Automatically creates an SSL connection between the MFT client and the FTP server (Default port 990). In SSL Explicit mode, the MFT client connects to the FTP server and then changes the connection to SSL mode (FTP over SSL/TLS).

Clear Command Channel

Sets the transmission mode in a control connection from an encrypted mode to clear text mode. You can secure sensitive information, including your user name and password, by sending them in an encrypted mode, and then use the CCC sub-command to change the transmission mode back to clear text mode to send the port and IP information (FTP over SSL/TLS).

Clear Data Channel

Encrypts the connection process while files are transferred without encryption. You can select this option if you want your login information encrypted and your files transferred without encryption.

SSL Security Level

Defines the SSL security levels for the host as the following:

  • 2: SSL is used for data encryption only
  • 3: Server Authentication
  • 4: Both server and client authentication

SFTP (SSH) Protocol Parameters

The following table lists the SFTP (SSH) protocol parameters.

Password and Key authentication must be used if the remote SFTP server both Password and Key. (AuthenticationMethod = "publickey,password")

Parameter

Description

Key Authentication

Uses Key Authentication to access the SFTP server. To generate SSH keys, see Generating SSH Keys.

Private Key Name

Defines the path and file name of the private key

Key Passphrase

Defines the password of the private key file

Password

Defines the password of the SFTP server

Compression

Compresses the file before the transfer

S3 Protocol Parameters

The following table describes S3 protocol parameters.

Parameter

Description

Storage Type

Determines one of the following S3 storage types:

  • Amazon S3 Storage: Amazon Simple Storage solution.

  • S3 Compatible Storage: A storage solution that allows you to access and manage the data it stores over an S3 compliant interface.

  • AWS PrivateLink for Amazon S3: A storage that resides in the virtual private cloud (VPC) endpoint.

REST Endpoint

Defines the network address where the S3 Compatible Storage is located.

Access Key

Determines the access key to Amazon S3 storage or S3 Compatible storage.

Secret Access Key

Determines the secret access key to Amazon S3 storage or S3 Compatible storage

Region

Determines the default region to perform the Amazon S3 requests. For better performance, select the region where the bucket is located.

Azure Storage Protocol Parameters

The following table describes the Azure Storage Connection Profile Parameters.

Parameter

Description

Account name

 Defines the name of the Azure Storage account

Storage Type

Determines whether to connect to one of following Azure Storage types:

  • Blob Storage

  • Data Lake Storage Gen2

Endpoint URL

Shows the URL of Blob Storage or Data Lake Storage where the file transfers are sent.

Default:

  • Blob: https://<account name>.blob.core.windows.net

  • Data Lake: https://<account name>.dfs.core.windows.net

Overwrite Endpoint URL

Overwrites the default Endpoint URL and allows you to connect to a different URL.
Authentication Method

  • Azure AD (Active Directory): Authenticates with Azure Active Directory IAM service

  • Shared Key: Authenticates using an Access Key

  • Shared Access Signature (SAS): Delegates access with specific permissions over a limited time interval

  • Managed Identity Service Uses a predefined Managed Identity to access the Azure storage services that do not require credentials.

    You can only use this option when Control-M/Agent is installed on an Azure virtual machine.
Using

Determines whether to connect to the Azure account with one of the following based on the Authentication Method:

  • Azure AD

    • User & Password: Authenticates a user in the Active Directory

    • Client Secret: Authenticates via an application secret

    • Certificate file:Authenticates a user with a certificate file.

      You can upload or create the certificate or secret for your application in the Azure Portal > Azure AD > App registration.

  • Shared Key

    • Access Key: Defines the account access key that is used to connect to Azure.

    • Connection String: Defines the entire connection string used to connect to Azure.

Tenant ID

Defines the ID of the Azure Active Directory instance where your application is located.

Client ID

Defines the ID of your application in Azure Active Directory.

Client Secret

Defines the name of the application secret.

Certificate File Type

Determines whether to use PEM or PFX as the certificate file.

Certificate File Path

Defines the location of the certificate file.

Certificate Password

Defines the password of the certificate.

SAS Token

Defines the SAS token that is created for Azure limited access.

Google Cloud Storage Parameters

The following table describes Google Cloud Storage parameters.

Parameter

Description

Service Account Key

Defines a JSON file that contains the required service account credentials to access the Google Cloud Storage account

Service account JSON format:

Copy 
{
"type": "service_account",
"project_id": "project-id",
"private_key_id": "key-id",
"private_key": "-----BEGIN PRIVATE KEY-----\nprivate-key\n-----END PRIVATE KEY-----\n",
"client_email": "service-account-email",
"client_id": "client-id",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://accounts.google.com/o/oauth2/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
}

AS2 Parameters

The following table describes AS2 parameters:

Parameter

Description

Partner AS2 ID

Defines the logical name of the remote AS2 server.

Destination URL

Defines the URL of the AS2 server

Partner Certificate Alias

Defines the alias of the partner certificate that is stored in the AS2 keystore

Sign Message

Determines whether to digitally sign the AS2 message with one of the listed algorithms

Encrypt Message

Determines whether to encrypt the AS2 message with one of the listed encryption algorithms

Request Receipt

Determines whether to receive a signed or unsigned MDN receipt of the AS2 message from the AS2 server that it was received and processed

Compress Message

Determines whether to compress the AS2 message when sent

User Name

Defines the username of the HTTP request for the AS2 message

Password

Defines the password of the HTTP request for the AS2 message

Confirm Password

Confirms the password of the HTTP request for the AS2 message

Send Message Timeout

Determines the number of seconds to wait for the AS2 server to reply before a timeout occurs

Default: 300

A-sync Receive Timeout

Determines the number of minutes to wait for the AS2 server to send the receipt before a timeout occurs

Default: 300

MFT Connection Profile Additional Parameters

The following table lists the connection profile additional parameters.

Parameter

Description

Verify destination file size

Verifies the size of the file after a successful transfer.

  • If a file transfer has spaces in the file name and it fails during this verification, you must not select this option, as some FTP servers do not list file names with spaces.

  • This option is only available when the source and destination servers are Windows, Linux, or UNIX.

  • This option is not available for AS2.

  • This option is only relevant for Binary mode transfer.

Verify total bytes sent

Determines whether to verify, after a successful transfer, if the actual number of bytes sent to destination is the same as the size of the file on the source.

If it is not the same size, the transfer fails.

  • This option is only available when the source and destination servers are Windows, Linux, or UNIX.

  • This option is not available for AS2.

  • This option is only relevant for Binary mode transfer.

Verify checksum

Verifies that the file transferred correctly by executing MD5 checksum on the FTP server.

This option is available only for FTP Servers that support either the XMD5 or the SITE CHECKSUM checksum commands.

For UNIX FTP servers, ensure that the md5sum program is installed on the FTP server search path, to enable the SITE CHECKMETHOD MD5 and SITE CHECKSUM commands to work properly.

Connection Profile Manual Additional Parameters

The following table describes the Connection profile manual additional parameters.

Parameter

Description

as2.compressMessageBeforeSign

Determines whether to compress AS2 message before signing the message.

EXAMPLE: true or false

azure.proxy.scheme

Determines which proxy scheme (https/http) to use when connecting to Azure via Web Proxy

ftp.charset

Uses a different character set when connecting to a remote FTP server (if not specified, UTF-8 is the default charset).

EXAMPLE: ISO-8859-1

ftp.path.with.spaces.improved.directory.listing

Determines whether the FTP client performs a directory listing on the whole directory when transferring specific file path that includes spaces such as, /aaa/bbb/ccc ddd.txt or square brackets.

This property has no affect if transferring a path without spaces or transferring directory or pattern. Use this property only if the Connection Profile is Windows or Linux (not supported on AIX).

EXAMPLE: true or false

ftp.timezone.offset

Defines the timezone offset of the remote FTP server. Use this if the FTP server timezone is different than the Control-M/Agent timezone.

Format: +/-HH:MM.

EXAMPLE: +04:00
  • ftp.performChangeDirectoryBeforeAction
  • sftp.performChangeDirectoryBeforeAction

Determines whether to change the working directory to the target FTP or SFTP path before writing a file.

EXAMPLE: true or false

sftp.charset

Uses a different character set when connecting to a remote SFTP server (if not specified, UTF-8 is the default charset)

EXAMPLE: ISO-8859-1

sftp.ciphers

Overrides the SFTP ciphers that are used when connecting to the SFTP server (commas separated values).

EXAMPLE: aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr

sftp.flush

Determines whether to ask SFTP server to flush any buffer than was sent (to verify the target file was updated in case of disconnections).

NOTE: If set to true, performance might be affected.

EXAMPLE: true or false

sftp.ignore.PreferredAuthentications

Determines whether to ignore the SFTP server’s preferred authentication list.

sftp.ignoreIsRemoteDirCheckingWhenStoreFile

Enables you to upload files to a specific server.

Default: true

sftp.ignore.StrictHostKeyChecking

Determines whether to perform SFTP server’s strict HostKey checking.

sftp.ignore.verify.signature

Determines whether to perform SFTP server’s signature verification.

sftp.kex

Overrides the SFTP key exchange algorithms that are used when connecting to the SFTP server (commas separated values).

EXAMPLE: ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha1,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group1-sha1

sftp.mac

Overrides the SFTP mac algorithms that are used when connecting to the SFTP server (commas separated values).

EXAMPLE: hmac-md5,hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5-96

sftp.newline

Defines CRLF or LF to override the ASCII End of Line control character abbreviation, when transferring with SFTP protocol and ASCII mode.

By default, End of Line is based on the Connection Profile OS type (Windows = CRLF, UNIX = LF).

EXAMPLE: CRLF or LF

sftp.remove.directory.trailing.slash

Determines whether the remote SFTP server enforces omitting a trailing slash when running directory operations (such as, mkdir and rmdir).

Default: Trailing slash

EXAMPLE: true or false

slowdown.rate.millisecond

Determines the number of milliseconds to wait between each read/write operation during transfer when the remote server is very slow.

EXAMPLE: 300

s3.enable.global.bucket.access

Forces global bucket access on the MFT S3 client for that connection profile.

s3.compatible.storage.region

Determines which region to use when connecting to a compatible S3 storage server.

s3.disable.chunked.encoding

Disables chunked transfer encoding for object writes and reads.

s3.disable.multipart.upload

Determines whether to disable multipart uploads for files size range of 16MB-5GB.

s3.proxy.host

Determines the hostname or IP of the web proxy server.

NOTE: The Connection Profile web proxy server settings override the Configuration Management web proxy server settings (see MFT Client Configuration Parameters).

s3.proxy.port

Determines the port number of the web proxy server.

NOTE: The Connection Profile web proxy server settings override the Configuration Management web proxy server settings (see MFT Client Configuration Parameters).

s3.role.arn

Defines the Amazon Resource Name of the role, which provides temporary access credentials when you assume the role.

s3.role.mfa.serial

Determines the serial number of the MFA device of the S3 role.

s3.role.session.duration.seconds

Determines the duration of the temporary access defined in s3.role.arn.

s3.role.external.id

Determines the external ID of the S3 role.

s3.set.api.version

Determines which REST API version to use .

Default: 2

s3.set.bucket.owner.full.control.canned.acl

Determines whether to provide full access to objects uploaded to any bucket in this connection profile.

s3.set.http.connection.protocol

Determines whether to use HTTP instead of HTTPS for S3 connections.

EXAMPLE: true or false

s3.useDefaultCredentialProviderChain

Determines whether to use the Instance profile credentials delivered through the Amazon EC2 metadata service.

This option only works when Control-M MFT and the Agent are running on an EC2 instance.

s3.use.virtual.hosted.style

Determines whether to use the virtual-hosted style (mybucket1. s3-eu-west-1.amazonaws.com) for S3 buckets on S3 API calls.

EXAMPLE: true or false

ssl.keystore.keyalias

Overrides the keystore alias

ssl.provider.options.tlsciphersuite

Overrides the enabled cipher suites

ssl.provider.options.sslprotocol

Overrides the enabled SSL protocols such as, SSLv3,TLSv1,TLSv1.1, and TLSv1.2.

If you want to work with SSLv3, mark the jdk.tls.disabledAlgorithms=SSLv3 attribute with #, and then restart the container.

To edit the file, use the following path: ${path}\BMC Software\Control-M Agent\Default\CM\AFT\JRE\lib\security

TLSv1.2

SSLv3,TLSv1

ui.max.records.in.list

Limits or extends the number of records returned to the File Transfer browser dialog.

By Default, 10,000 records are returned

EXAMPLE: 20000

use.proxy

Determines whether to connect to the SFTP, FTP, or S3 server via Web Proxy, if enabled in the Configuration Management window.

Default: true