title: Best way to implement an SFTP server solution?
body: <p>I'm currently setting up a commercial SFTP server and I'm just looking for some of your opinions on the set-up I'm currently thinking of implementing, as well as a recommendation as to what commercial Secure FTP server software would be best to suit. Bear in mind that the data i'm responsible for is highly sensitive so any comments/feedback is much appreciated.</p>
  
  <p>Here's the scenario:</p>
  
  <p>1) Before file upload, files are compressed &amp; encrypted using AES 256 with a salt.</p>
  
  <p>2) Files uploaded from the clients' server over SFTP (port 22) to our SFTP server.</p>
  
  <p>3) Files are then downloaded over HTTPS by our other client using one time password verification (strong 10 char alphanumeric password)</p>
  
  <p>The specifics of the implementation I'm thinking of are:</p>
  
  <p>For part (2) above, the connection is opened using host key matching, public key authentication and a user name/password combination. The firewall at both sides is restricted to only allow the static IP of the client server to connect.</p>
  
  <p>For part (3), the other client is supplied with a user name/password on a per user basis (for auditing) to log into their jailed account on the server. the encryption password for the file itself is supplied on a per file basis, so i'm trying to apply two modes of encryption at all times here (except when the files are resting on the server).</p>
  
  <p>Along with dedicated firewalls on both sides, Access control on the SFTP server will be configured to block IP addresses with a certain number of failed attempts over a short time, invalid passwords attempts will lock out users, password policies will be implemented etc.</p>
  
  <p>I like to think that I've covered as much as possible but I'd love to hear what you guys think about this implementation?</p>
  
  <p>For the commercial server side of things, I've narrowed it down to GloalSCAPE SFTP w/ SSH  &amp; HTTP module or JSCAPE Secure FTP server - I'll be assessing the suitability of each over the weekend but if any of you have any experience with either i'd love to hear about it also.</p>