Active Directory for SFTP — read-only vs read-write groups
How the server reads the user’s AD group membership at every login and decides read-write, read-only, or default access — two XML elements, no scripts, no sync jobs.
Read article ›Field notes, deep dives, and how-tos on SFTP, FTPS, WebDAV, and secure file transfer engineering. Updated weekly.
How the server reads the user’s AD group membership at every login and decides read-write, read-only, or default access — two XML elements, no scripts, no sync jobs.
Read article ›We kept our release notes in three hand-written copies, and they drifted — of course they did. Now one XML document generates the web page, the installer's FIXES.txt, and the update feed our servers read — and our first-ever phone-home sends nothing at all, because the feed is just the release notes.
Read article ›Seven polling timers kept the consoles fresh-ish. All of them are gone: every surface now updates by server push. The signal-then-refetch design, why a storm must cost one signal, watching folders nobody uploads through — and the caching bug that made 21 ms look like 30 seconds.
Read article ›Guarding the MCP tools leaves a side door open — the assistant already holds a token for the ordinary REST API. Why the block is enforced by credential type rather than tool name, and an honest account of the one case no server can cover.
Read article ›A thousand users is not a thousand transfers. Capacity planning grounded in the server's actual internals — NIO threading, bounded queues and caches, staging-volume math, and the quota arithmetic that sizes your disk.
Read article ›The Knowledge Base inside Stylus SFTP Server has a native MCP server. We let an AI assistant author a complete partner knowledge base through it — OAuth sign-in, drafts-first, tenant walls intact — and the git-backed history labeled every revision it made.
Read article ›One upload event, delivered simultaneously to the database, your SIEM over RFC 5424 syslog, a signed webhook, and an email threshold rule. What each sink actually emits, and the single config block that turns them all on.
Read article ›ATOMIC_MOVE is the difference between a downstream job seeing a whole file and seeing half of one. Here is what it guarantees, why it only holds within a single filesystem, and what happens when staging and target live on different volumes.
Read article ›Step-by-step walkthrough of enabling TOTP multi-factor authentication on Stylus SFTP Server and enrolling users through the Web File Portal.
Read article ›Most SFTP servers write directly to the target file. That means downstream consumers see partial writes. Here is how atomic staging, ATOMIC_MOVE, and a configurable rename pattern eliminate the problem.
Read article ›The Activities tab shows three charts that refresh every ten seconds. Each line is sourced from a different place in the server and answers a different operational question. Here is what they measure and what a spike means.
Read article ›A war story from our own test bench. 92% of the way through a 9 GB upload, the disk filled up — not with the file, but with the database's record of how to undo writing the file. Here is the autopsy.
Read article ›A walkthrough of how the same credential leak plays out on a password-only SFTP listener versus one with MFA enabled. The asymmetry is large; the design choice is cheap.
Read article ›An AI agent writes this blog every week and publishes it to production. Its only credential is one SFTP login. Here is why that turned out to be the right boundary — and what the deployment actually looks like.
Read article ›Most SFTP servers put files on disk. Some of them really shouldn't. Here's when a database-backed storage layer wins on operations, what it costs, and what we built when we shipped one.
Read article ›One post per week. Watch this space — or come back the same time each Tuesday.
Free evaluation key, full feature set, install in minutes — SFTP, FTPS, WebDAV, browser portal, and audit out of the box.