Session File Transfer ​

Remote sessions can move files between the user's computer and the target. One setting controls it for both RDP and SSH targets, and every file that moves is recorded in the audit log with its name, size, and SHA-256 checksum.

On RDP targets, files travel through a session drive that appears on the remote machine. On SSH targets, files travel over SFTP: when downloads are allowed, the user gets a file browser in the session's Files panel.

Zone defaults now apply to SSH targets

Until now, the zone's file transfer default had no effect on SSH targets. It now applies to them as well. Before this release reaches your tenant, check the Session Feature Defaults of every zone that contains SSH targets, and set file transfer to Off on any zone or target where SSH users should not move files.

The File Transfer Setting ​

File transfer is directional, like the clipboard setting:

ValueWhat the user can do
OffNo file transfer. This is the default.
Upload onlySend files from their computer to the target.
Download onlySave files from the target to their computer.
Upload and downloadBoth.

You set it in two places:

  • Zone default: under Admin → Sessions → Zones, edit a zone and choose File transfer under Session Feature Defaults. It applies to every RDP and SSH target in the zone that does not override it.
  • Per target: under Admin → Sessions → RDP or SSH, edit a target and open Session Features. Session features are inherited from the zone as a set: while Clipboard is set to Inherit from zone, the target takes clipboard, file transfer and audio from its zone. Choose a clipboard value to override them, and the File transfer field appears.

A session keeps the setting it opened with. Changing the setting affects the next session, not one that is already running. VNC targets have no file transfer.

RDP Targets ​

On an RDP target, files go through the \\tsclient\GrantFlow drive on the remote machine. Uploaded files appear on that drive. To download a file, the user copies it into \\tsclient\GrantFlow\Download, and the browser saves it. The session drive holds up to 200 MB in total by default. The Files panel shows how much of it is used and warns when it is nearly full; a session whose drive exceeds the limit ends.

SSH Targets ​

On an SSH target, file transfer runs over SFTP with the rights of the account that signed in to the session. What the user sees in the Files panel depends on whether downloads are allowed.

With Downloads Allowed ​

With Download only or Upload and download, the Files panel shows a file browser:

  • It starts at the root directory / and lets the user open any directory the signed-in account can read. The account's rights on the host are the boundary, as in the shell. Symbolic links are followed.
  • Folders are listed first, then files, by name. A file downloads on click.
  • File names come from the remote host and are shown as plain text. Invisible and right-to-left control characters are made visible, so a name cannot disguise itself as another.
  • The browser shows 500 entries at a time, with Show more and a name filter. A directory with more than roughly 10,000 to 20,000 entries cannot be listed and shows This directory is too large to show.

With Upload and download, the user can also drop files on the panel or choose them, and they upload into the directory the browser shows. If a file of the same name already exists there, the panel asks first: the user chooses Replace or Cancel.

With Uploads Only ​

With Upload only, there is no file browser, because a directory listing would let file names carry data out of the host. Uploaded files go to the signed-in account's home directory and replace a file of the same name there without asking. The panel says so next to the upload area.

Dropping files on the terminal uploads them the same way: into the directory the browser shows, or into the home directory when there is no browser.

Pinned Host Key Required ​

SFTP on an SSH target requires a pinned host key, which is how GrantFlow knows the file transfer connection reaches the same server as the terminal. A new SSH target pins its key on its first session and has file transfer from that session on. You can also pin it ahead of time with Read identity and Pin observed identity on the target.

If an admin pins a different key while a session is running, that session's file transfer connection no longer matches, and the session ends with the file transfer error below.

Size Limits ​

Each file can be up to 200 MB by default, in both directions, the same limit as an RDP session drive. SSH sessions have no total per session. The panel checks each file's size before sending it, and refuses a larger file with a message that names the file and the limit.

Audit and Monitoring ​

Every file transfer creates a Session File Transferred audit event with the direction, file name, size, SHA-256 checksum, and outcome. For SSH transfers through the file browser, the event also records the directory. Uploads to the home directory record no directory.

Directory listings are not logged one by one. GrantFlow counts them per session and writes one Session Directories Listed event when the session ends, if the browser listed anything. A listing only ever shows what a download could reach, because SSH sessions without downloads have no browser.

When the file transfer connection of an SSH session opens, or is refused, GrantFlow writes a Session File Browser Connected event.

On Admin → Sessions → Live Sessions, an SSH session with a file transfer connection carries an SFTP badge, so a connection into the network segment is never invisible.

When a session is recorded, the recording notice tells the user that file transfers are logged with name, path, size and checksum. Browsing and transfers do not appear in the video.

Agent Capacity ​

Each SSH session with file transfer uses two connections on a tunnel agent, one for the terminal and one for SFTP. Zone and per-user session limits still count it as one session.

Each tunnel agent carries a limited number of connections at once, set as Max concurrent sessions in its Tunnel Limits (8 when no limit has been set). Size each zone so that, on top of the other sessions its agents carry:

text
tunnel agents in the zone ≥ ⌈ 2 × concurrent SSH sessions with file transfer ÷ Max concurrent sessions ⌉

For example, a zone that should carry 20 SSH sessions with file transfer at once needs five agents at the default of 8, or one agent whose limit you raise to at least 40. When an agent is full, the user can already be signed in to the terminal before the file transfer connection is refused, and the session then ends.

Troubleshooting ​

The Session Ends with a File Transfer Error ​

The end screen reads: "The file transfer connection to the host could not be established. An administrator can turn file transfer off for this target to open it without."

GrantFlow does not retry the file transfer connection: if it fails, the whole session ends. Common causes:

  • The zone's tunnel agents are at their connection limit. See Agent Capacity.
  • The target's host key was re-pinned while the session was opening.
  • A short-lived problem while the session was opening, such as a timing issue during sign-in or a GrantFlow update in progress. Opening the session again usually works.

To give users a terminal while you investigate, set file transfer to Off for that target.

The Panel Says "File Transfer Disconnected" ​

The file transfer connection ended while the terminal was still running. The terminal keeps working; transfers that were in progress are marked as aborted. Open a new session to transfer files again.

No File Browser ​

The target allows Upload only, or the session opened before file transfer was turned on. A file browser needs Download only or Upload and download.

Known Limits ​

  • Throughput: transfers run at roughly 130 to 200 KiB/s with a 30 ms round trip to the target, so a 200 MB file takes 20 to 25 minutes. RDP transfers behave the same.
  • "Completed" means the host ended the transfer. If the host stops reading a file partway, the download still ends normally and is recorded as completed. The recorded size and checksum always describe exactly the bytes the user received.
  • Overwrites cannot be undone. An upload replaces a file of the same name on the host, and an upload that stops partway leaves a truncated file.
  • No retry: a file transfer connection that cannot be established ends the session, as described above.

MCP Tools ​

AI assistants connected through the GrantFlow MCP server can read the file transfer configuration:

  • session_target_list shows each target's fileTransfer, where it comes from in fileTransferSource (target, zone, or protocol_unsupported), and for SSH targets whether a host key is pinned in hostKeyPinned. A new protocol filter (rdp, ssh, vnc) answers questions such as "which SSH targets allow downloads?".
  • session_zone_list shows each zone's default fileTransfer.

These fields show the configuration, not whether a host's SFTP service answers. Changing the setting is done in the admin portal.