Connect an SFTP server

SFTP is a way of storing files on a server over a secure connection. Linux servers and many NAS devices offer it.

What JUDLEX asks for

In Settings → Data → Add a connection, choose SFTP and fill in Server, Port (almost always 22), Username and, if you like, Folder. If you paste a whole address into Server, such as sftp://ana@nas.yourfirm.com:2222, JUDLEX splits it into its fields.

The Folder works like this:

Empty: the user's home folder on the server. It is the simplest option and almost always works.
Without a leading slash (backups): a folder inside the home folder (your folder/backups).
With a leading slash (/volume1/firm): a full path on the server.

Except for the home folder, the folder must already exist and the user must be able to write in it: JUDLEX does not create it, so a typo never ends up saving somewhere else. Inside it, JUDLEX works in a JUDLEX folder that it does create. .. is not allowed.

What JUDLEX creates can only be read by that user on the server. If the folder is a team folder (its group can write in it), it creates its items for that group too, so colleagues who sign in as other users of the same group can use them. Whoever runs the server has the details in the technical guide.

If something is missing for the button to work, the line above it says what: check the server, tick that the fingerprint matches, generate the key or enter the password.

Checking the server

Click Check the server. JUDLEX shows you the server's key type and its fingerprint, which looks something like ED25519 · SHA256:Nf0x6mJ3….

Compare it with the one given to you by whoever runs the server, in full and character by character, and tick the box to say it matches. Whoever runs it can see it on the server itself with ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub (with ecdsa or rsa instead of ed25519 if JUDLEX shows a different type).

JUDLEX remembers the fingerprint and its type: if they ever change, it refuses to connect and sends nothing, because that is exactly what would happen if someone were pretending to be your server.

If whoever runs the server really has changed it (for example, when reinstalling it), you do not need to remove the connection: in its menu, choose Change the details… → Check the server, compare the new fingerprint, tick it and click Test and save.

With a key from this computer (recommended)

Choose With a key from this computer (recommended).
Click Generate this computer's key. A line starting with ssh-ed25519 appears.
Click Copy the line and give it to whoever runs the server, so that they add it to the user's ~/.ssh/authorized_keys file. It is the public part: it is not secret. On a Windows server, if the user is an administrator, the line goes in C:\ProgramData\ssh\administrators_authorized_keys.
You do not have to wait for it to be installed: you can click Connect and test straight away. If the line is not on the server yet, the test fails, but the connection is saved. When they tell you it is done, click Connect and test again in the same window, or close it with Save as is and close and later use Test in the connection's menu.

The private part of the key never leaves this computer, and it is not included in the backup either.

With a key you already have

If whoever runs the server gave you a key, or you have the one from another computer, click Use a key I already have…. Paste the private part (it starts with -----BEGIN; PuTTY keys, with PuTTY-User-Key-File) or click Choose the file…. If the key has a passphrase, type it in Passphrase: JUDLEX opens the key with it and keeps it already opened on this computer. Then click Use this key.

JUDLEX shows you its public line, which has to be on the server already. Ed25519, ECDSA and RSA keys work.

With a password

Choose With a password and type it in. This works, but a key is safer and can be revoked without changing any password. Servers that ask for the password as a separate prompt (some NAS devices do) also work.

What JUDLEX cannot do is sign in to a server that asks for a second step: a code, or the key plus the password. For this user, ask whoever runs it to make one step enough.

Reconnecting with a key

In the connection's menu, Reconnect shows the line of its key, so you can check that it is still on the server and under the right user, and Test again.

If you would rather use another key, click Make a new key, ask for its line to be added and click Save and test. Or click Use a key I already have… to use one that is already on the server. The connection keeps the previous key until the test with the new one passes: if it fails, nothing changes, and you can click again once the line has been added. If you close the window without testing, the new key is discarded.

Restoring the firm on another computer

Since the key is not in the backup, the new computer does not have it. There are two ways:

If you have the key (the one whoever runs the server gave you, or a copy of the old one): when you add the connection to restore, use Use a key I already have…. The server does not have to be touched.
If you do not: make a new key and ask for its line to be added to the server. The old computer's line can be removed afterwards.

After restoring, the connection asks you to Sign in again: in Reconnect, JUDLEX tells you that this computer does not have the key and offers both ways. Click Save and test when the key is ready.

If the test fails

It does not let JUDLEX in: almost always, the key's line is not on the server yet, or it is under another user. With a password, the password is wrong.
Permission denied or does not let it do this: the user signs in but cannot write in the folder. Leave Folder empty to use the home folder, or ask for write permission on the one you chose.
The folder does not exist: the folder you typed (with or without a slash) must exist. Create it first, or leave the field empty to use the home folder.
The server would not save the file although the disk has room: almost always the user has a space limit and has reached it. Ask whoever runs it to raise it or free some space.
No encryption method in common: a very old SSH server. It needs updating.

You change the details with Change the details… in the connection's menu. JUDLEX tests before saving them: if the test fails, the connection stays as it was.

On a Synology

Whoever runs the NAS: in Control Panel → File Services → FTP → SFTP, enable the SFTP service; in User & Group → Advanced, enable the user home service (so that each user has their own home folder); and give the JUDLEX user read and write permission on its folder. With Folder empty, JUDLEX stores in that home folder. For a shared folder, enter its path as the user sees it over SFTP: on a Synology it is usually a slash and the shared folder's name, such as /firm.

SFTP does not create links. You can share through the firm folder if your colleagues use the same server and the same folder. See Share a matter or a case file with a colleague.