True Tenant Isolation
Each LDAP group maps to an isolated home directory. Clients cannot see, access, or even discover other tenants' files. Quotas prevent any single client from consuming all disk space.
One server, 20 clients, complete isolation — with LDAP groups, per-client quotas, webhook integrations, and centralized monitoring from a single admin console.
Managed service providers need to offer secure file transfer to multiple clients. Each client expects isolation, audit trails, and integration with their own systems — but the MSP needs a single pane of glass.
Running a separate SFTP instance for each client means 20 servers to patch, 20 sets of certificates to rotate, and 20 separate monitoring dashboards. Operational overhead grows linearly with your client count.
Clients need different things: one wants webhook notifications to ServiceNow, another needs email alerts to Jira. One client is read-only, another uploads daily. All of them want proof that their data is isolated from other tenants.
And when disk space runs low or a TLS certificate is about to expire, the MSP needs to know immediately — not when a client calls to complain.
✓ 20 clients, one server
✓ Complete home directory isolation
✓ Per-client quotas and audit
✓ Webhook to each client's ticketing
✓ Disk/cert alerts to MSP NOC
✓ Single admin console for all
Each client maps to an LDAP group. Users in that group get an isolated home directory. Quotas, audit trails, and webhook integrations are configured per user or per event. The MSP monitors everything from the Web Admin Console.
Each client is an LDAP group with an isolated home directory. Webhooks route events to each client's ticketing system. The MSP monitors all clients from one console.
LDAP group isolation, per-user quotas, per-client webhooks, volume guard alerts, and admin email notifications — all from XML.
<user-manager>
<provider>ldap</provider>
<ldap>
<url>ldaps://dc.msp.local:636</url>
<search-base>DC=msp,DC=local</search-base>
<bind-dn>CN=svc-sftp,OU=Services,DC=msp,DC=local</bind-dn>
<!-- Each client is an AD group -->
<access-groups>
<group>CN=Client-AcmeCorp</group>
<group>CN=Client-BetaInc</group>
<group>CN=Client-GammaLLC</group>
</access-groups>
<!-- Audit-only clients: download but no upload -->
<read-only-groups>
<group>CN=Client-DeltaAudit</group>
</read-only-groups>
</ldap>
</user-manager>
<filesystem
xmlns="http://www.xmlpipelineserver.com/sftp/">
<home-root>${STYLUS_SFTPSERVER_DATA}/homes/${username}</home-root>
<default-access>read-write</default-access>
<quotas>
<default-quota>10GB</default-quota>
</quotas>
<!-- Alert MSP when disk runs low -->
<volume-guard>
<min-free-bytes>10737418240</min-free-bytes>
<!-- 10 GB minimum free space -->
</volume-guard>
</filesystem>
<audit>
<webhooks>
<!-- Client A: notify ServiceNow on file arrival -->
<webhook>
<url>https://acme.service-now.com/api/sftp</url>
<events>UPLOAD</events>
<hmac-secret>${ACME_HMAC}</hmac-secret>
</webhook>
<!-- Client B: notify Jira on file arrival -->
<webhook>
<url>https://beta.atlassian.net/rest/sftp</url>
<events>UPLOAD</events>
<hmac-secret>${BETA_HMAC}</hmac-secret>
</webhook>
</webhooks>
<!-- MSP NOC email alerts -->
<admin-alerts>
<recipients>noc@msp.example.com</recipients>
<events>VOLUME_LOW, CERT_EXPIRING, LICENSE_EXPIRING</events>
</admin-alerts>
</audit>
Each LDAP group maps to an isolated home directory. Clients cannot see, access, or even discover other tenants' files. Quotas prevent any single client from consuming all disk space.
The audit database records every event with the username and home directory. Filter by client for compliance reports or export per-tenant audit logs for client review.
Volume Guard warns before disk space runs out. Certificate expiry alerts fire 30 days in advance. The MSP NOC knows about problems before clients do.
The Web Admin Console shows sessions, audit events, and disk usage for all clients in one dashboard. Add a new client by creating an AD group — no server restart needed.