Application Properties for application.properties

TLDR - Quick Summary

What: Reference for commonly configured properties in SFTP Gateway

Config File: /opt/sftpgw/application.properties

Apply Changes: service sftpgw-admin-api restart

Start with: the eight properties under Most commonly changed below. The JVM heap is not in this file; it lives in the service .conf file.

Overview

This reference lists the commonly configured properties in /opt/sftpgw/application.properties. After editing the file, restart the service:

service sftpgw-admin-api restart

Most commonly changed

Most deployments only ever touch a handful of these settings. Each one links to the article that walks through the change.

Property	Change it when	Guide
logging.level.com.sftpgateway.backend.sftp.logging.MaverickLogService	Support asks for DEBUG output while troubleshooting an SFTP issue	Logging
features.file-system.azure.block-size-mb	Uploads above about 200 GB fail and "keep restarting"	Increasing Max Upload File Size
features.sftp-subsystem.enable-default-ip-banning-policy	A misconfigured client keeps banning its own IP address	Disabling IP Banning
sftp.connection-idle-timeout-seconds	Clients leave sessions open and the heap fills up	Performance Tuning
sftp.port	Clients need SFTP on a port other than 22	Changing the SFTP Port
features.file-system.ignore-folder-metadata	Directory listings are slow, or storage request charges are high, with many folders	Performance Tuning
sftp.security-level	A legacy client needs older SSH algorithms	Encryption Algorithms
spring.datasource.hikari.maximum-pool-size	Logins are slow under a high connection rate, or in a high-availability deployment	Performance Tuning

The other setting changed most often is not in this file at all: the JVM heap (-Xmx) lives in the service .conf file. See Configuring VM Memory Settings.

Everything below is the full reference. Properties marked ⚠️ should be left alone.

SFTP Server Configuration

Property	Default	Description
sftp.security-level	CUSTOM	Which SSH algorithms the SFTP server accepts. CUSTOM (the default) uses the algorithms enabled in the web admin interface under Settings > Encryption Algorithms (available since 3.5.0); see Encryption Algorithms. The fixed levels PARANOID, STRONG, and WEAK are still accepted; see Security Level Configuration.
sftp.port	22	The port on which the SFTP server listens for connections
sftp.host-address	0.0.0.0	⚠️ Interface the SFTP server binds to. Leave at 0.0.0.0 (all interfaces); binding to an address clients cannot reach takes the SFTP service offline.
sftp.connection-idle-timeout-seconds	1200	Maximum time (in seconds) an idle connected SFTP session can remain open before being automatically closed
sftp.auth-idle-timeout-seconds	120	Maximum time (in seconds) allowed for authentication before the connection is terminated
features.sftp-subsystem.enable-default-ip-banning-policy	true	When enabled, automatically bans IP addresses after too many failed login attempts
features.sftp-subsystem.scp-enabled	true	Enables or disables SCP (Secure Copy Protocol) functionality
features.sftp-subsystem.load-balancer.enable-proxy-protocol	false	Accept PROXY protocol headers from a load balancer so the real client IP is logged and used for IP banning. Required behind an Azure Load Balancer in high-availability deployments. See Performance Tuning.
features.sftp-subsystem.load-balancer.ip-addresses	(none)	Comma-separated load balancer addresses trusted to send PROXY protocol headers.

Security and Authentication Settings

Property	Default	Description
security.max-login-failed-attempts	10	Number of failed login attempts allowed before account lockout
security.failed-login-timeout-seconds	3600	Duration (in seconds) an account remains locked after exceeding maximum failed login attempts
password.encoder.pbkdf2.salt-length	16	⚠️ Do not change. Salt length for stored password hashes. Changing it invalidates every existing password and locks users out.
password.encoder.pbkdf2.iterations	5000	⚠️ Do not change. PBKDF2 iteration count for stored password hashes. Changing it invalidates every existing password, and lowering it weakens them.
username.minlength	1	Minimum allowed username length. Rarely changed.

Web API Configuration

Property	Default	Description
features.api.cors-allowed-origin-pattern	*	Allowed CORS origin pattern for the web admin API. Default * permits access via any hostname; restrict for security-conscious deployments, e.g. https://sftp.example.com. (Commented out by default in the shipped file.)

Password Policy Configuration

Property	Default	Description
password.policy.word-file	classpath:100k-most-used-passwords-NCSC.txt	Word list of common passwords that are rejected. It is packaged inside the application and cannot be replaced on the appliance; shown for completeness.
password.policy.required-upper-count	1	Minimum number of uppercase characters required in passwords
password.policy.required-digit-count	1	Minimum number of digits required in passwords
password.policy.required-lower-count	1	Minimum number of lowercase characters required in passwords
password.policy.required-special-count	1	Minimum number of special characters required in passwords
password.policy.require-digit	false	Boolean flag requiring at least one digit in passwords
password.policy.require-lower	false	Boolean flag requiring at least one lowercase character in passwords
password.policy.require-special	false	Boolean flag requiring at least one special character in passwords
password.policy.require-upper	false	Boolean flag requiring at least one uppercase character in passwords
password.policy.min-length	12	Minimum password length. Built-in default; not listed in the shipped file.
password.policy.max-length	128	Maximum password length. Built-in default; not listed in the shipped file.
password.policy.suggested-length	20	Length of passwords generated by the web admin interface. The shipped file has this line commented out, but the built-in default of 20 applies; set it only to change the generated length.
password.policy.prevent-previously-used-password-count	5	Number of previous passwords that cannot be reused

Database Connection Settings

Property	Default	Description
spring.datasource.hikari.maximum-pool-size	10	Maximum size of the database connection pool
spring.datasource.hikari.minimum-idle	5	Minimum number of idle connections maintained in the pool
spring.datasource.hikari.idle-timeout	120000	Maximum time (in milliseconds) a connection can remain idle before being closed
spring.datasource.hikari.connection-timeout	30000	Maximum time (in milliseconds) to wait for a connection from the pool
spring.datasource.hikari.max-lifetime	1800000	Maximum lifetime (in milliseconds) of a connection in the pool

PostgreSQL Connection Parameters

Property	Default	Description
spring.datasource.hikari.data-source-properties.tcpKeepAlive	true	Enables TCP keep-alive packets for PostgreSQL connections
spring.datasource.hikari.data-source-properties.keepaliveTime	60	Time (in seconds) between TCP keep-alive packets
spring.datasource.hikari.data-source-properties.socketTimeout	60	Socket timeout (in seconds) for PostgreSQL connections

Note: Leave the pool timeouts and PostgreSQL keepalive settings above at their defaults unless Thorn Tech support asks you to change them. The two values worth tuning are maximum-pool-size and minimum-idle; see Performance Tuning.

File System Features and Storage Configuration

Property	Default	Description
features.file-system.azure.block-size-mb	4	Block size (in MB) for Azure Blob Storage uploads
features.file-system.ignore-folder-metadata	false	When enabled, metadata for folders will not be stored or retrieved
features.file-system.connectivity-test-time-out-seconds	30	Timeout (in seconds) for storage connectivity tests

To raise the maximum single-file upload size, see Increasing Max Upload File Size.

Instance and Backup Settings

Property	Default	Description
features.instance.backup-import-max-file-size-megabytes	100	Maximum allowed size (in MB) for backup import files

Logging Configuration

Property	Default	Description
logging.level.com.sftpgateway.backend.sftp.logging.MaverickLogService	INFO	Log level for the SFTP service. Possible values: ERROR, WARN, INFO, DEBUG, TRACE

Log rotation and retention are configured in logback rather than in this file. See Logging to keep more days of logs.

Notes

1. Boolean values are case-sensitive and must be lowercase (true or false).
2. Changes take effect after a service restart.

For more information about SFTP Gateway, please refer to our Release Notes and Environment Variables documentation.