Architecture

A unified platform where five protocols share one storage layer, one authentication chain, and one audit pipeline.

Five Protocols, One Server

Every protocol connects through the same authentication, quota, and audit infrastructure. Users get a single home directory regardless of how they connect.

SFTP :22 FTP :21 FTPS :990 WebDAV :9980 Web Portal :9980 Stylus SFTP Server Auth + Quota + Routing Upload Lifecycle StorageBackend Unified Interface Local Filesystem Database H2 MySQL PostgreSQL SQL Server Audit Trail DB + Log + Syslog + Webhook

All five protocols share a single StorageBackend interface. Switching between local filesystem and database storage requires no client-side changes.

One Interface, Two Storage Backends

The VirtualRoutingFileSystemAccessor presents a unified file tree to every protocol. Under the hood, files can live on disk or in the database.

VirtualRoutingFileSystemAccessor Chroot + path resolution + quota enforcement LocalStorageBackend java.nio.file.Files homes/ ${username}/ directories JdbcStorageBackend HikariCP + SQL Database Schema sftp_files id, parent_id, name, is_dir, size, content_id sftp_file_content id, sha256, ref_count, total_size sftp_file_chunks content_id, seq, chunk_data (BLOB) sftp_file_locks file_id, owner, lock_type, expires COW copy: ref_count++ (no data dup)

Copy-on-write (COW): copying a file increments ref_count on the content row. Data is only duplicated when one copy is modified.

Pluggable Identity Chain

One authentication provider is active at a time. Every login traverses the full security chain — from identity verification through MFA to session creation.

LDAP / AD JDBC Database XML (users.xml) Public Key (keys.xml) one active at a time SftpAuthenticator Credential check Lockout Tracker Fail count + cooldown MFA (TOTP) RFC 6238 Session Authenticated AUTH_FAILURE LOCKED_OUT MFA_FAILURE Every outcome emits an audit event

Each stage can reject the login independently. All outcomes — success and failure — are recorded in the audit trail.

Four Sinks, Zero Lost Events

Every file transfer event flows through an async queue to four parallel sinks. Email notifications layer on top with configurable rules.

AUTH_SUCCESS UPLOAD DOWNLOAD DELETE 15+ event types... Async Queue LinkedBlockingQueue capacity: 10,000 Database sftp_audit table Log File SLF4J / Log4j 2 Syslog RFC 5424 / UDP Webhook HMAC-SHA256 signed Email SMTP + STARTTLS Rule-based triggers All four sinks fire in parallel — no event is dropped if one sink fails

The async queue decouples event producers from consumers. Non-blocking writes ensure file transfer latency is never affected by audit overhead.

Three Tools, One Engine

The CLI, Swing GUI, and Web Console all delegate to a shared AdminEngine. Every operation available in one tool is available in all three.

CLI 61 commands admin.bat / admin.sh Swing Desktop GUI 11 tabs Real-time refresh Web Console Ext JS on port 9980 60+ REST endpoints AdminEngine Shared business logic Config + Users + Audit + Certs User Management CRUD + enable/disable + MFA Configuration XML read/write + hot reload Monitoring Sessions + Audit + Status Certificates Generate + import + view

Full feature parity across all three surfaces. Automate with the CLI, manage interactively with the GUI, or use the web console from any browser.

See the Architecture in Action

Download the free evaluation and explore every layer — from protocol to storage to audit.

Start Free Evaluation