0

We have received a notification from Salesforce about Marketing Cloud File Transfer Activity Changes where they are disabling FTP protocol and enabling SFTP.

We as an organization are already using SFTP(with strong cipher keys)but when we raised a Case to Salesforce Support,they say we need to use SSH keys to connect to Marketing cloud FTP now.This will be a major change for us.There are multiple third party vendors which place files on SFMC FTP(by using the username and password which we had generated for their FTP location). Also there are business users(several departments) which connect to FTP to check their files or places files manually.Do we need to generate SSH keys for all of them? or we generate ssh keys for all of them and pass the public keys to Salesforce and private keys to vendors and marketing users ?

Is there an efficient way of doing this?

This is how I connect now:

enter image description here

This is how Salesforce Support is proposing we need to connect:

enter image description here

Improve this question

2 Answers 2

Reset to default
2

Edit

A teammate of mine received the following response from SFMC about this issue:

...the configuration team... confirmed that the combination of both a strong password and cipher will be enough to connect after the transition. So make sure to update your FTP client even on the third party side and no more action is required, SSH keys are not mandatory but are a preferred and encourage method of authentication.

The support person was likely confused. If you are utilizing the correct SFTP process already then it should have little to no change requirements on your end. There are a few different ways SSH is involved inside of SFTP.

SFTP utilizes SSH protocol. In a nutshell, this is the similar to the difference between HTTP and HTTPS. It helps protect at a broad level from malicious actions or events (password sniffing, man-in-the-middle attacks, etc). It does allow for password as well as key authentication.

SSH keys are another form of access credentials inside of SSH protocol. A lot of times, there are used for automation and Single Sign-on systems. They are not required in order to utilize SSH protocol though.

I think since this is not very common knowledge, as most people when they think SSH and SFTP, they think of the keys, not realizing that the 'S' in SFTP is because of SSH providing 'Security' on your FTP server.

Improve this answer
5
  • Thanks @Gortonington .This is the response of Salesforce support again:"I confirm that only SSH keys connection will work after the transition, password only is not considered as SFTP without a SSH Key. Connections without SSH key will be rejected after the transition."
    – Chetan
    May 12, 2020 at 11:38
  • I have been told by my SF peeps that is not the case. This is odd. But I suppose mixed messages from SFMC is not new. I will keep looking into it and see if I can get anything definitive.
    – Gortonington
    May 12, 2020 at 16:43
  • @Chetan - trying to get something more official and concrete now, but based off the announcement email and this doc (help.salesforce.com/articleView?id=mc_es_enhanced_ftp_guide.htm) which mentions only that there are non-supported algorithms that are no longer supported, not that user/pass is no longer allowed.
    – Gortonington
    May 12, 2020 at 16:53
  • so SFMC has yet to officially clarify it. I would ask your Support person to provide you with written supporting documents on this requirement to you as everything they released never mentioned user/pass going away so you need something to show your IT/Leadership team in order to authorize the added work.
    – Gortonington
    May 12, 2020 at 17:02
  • 1
    @Chetan - see my edited answer for a direct response from SFMC saying that SSH Keys are not required.
    – Gortonington
    May 14, 2020 at 15:53
1

Am not sure on the point - "salesforce support say we need to use SSH keys to connect to Marketing cloud FTP now." Please double check with them again. I believe they are still supporting with passwords for SFTP.

Since your question is more related to generating SSH key. Please follow the below procedure.

  1. You can request to SF support to enable SSH key of the option to access SFTP along with password or SSH key. In this way you can still access SFTP with password or SSH.
  2. Once they have enabled then you can create a Public SSH key or 3rd party can able to create a key. There are many tools for it like PuttyGen Make sure your SSH has strong cipher key.

Please find the formats for SSH:

https://help.salesforce.com/articleView?id=mc_es_enhanced_ftp_guide.htm&type=5 https://help.salesforce.com/articleView?id=000351981&type=1&mode=1

  1. You can create one public SSH key for one BU and share it across teams.
  2. Once this is done. Then you can or 3rd party team can able to access SFMC SFTP via SSH.

Let me know if this helps.

Improve this answer
6
  • 2
    I am pretty sure this is accurate. My interpretation is also that username/password stays as an option, and the linked documentation mentions username / password multiple times. I have enabled SSH for an integration last week and did exactly as Naveen laid out. Specifically I requested to leave the option for username/pw authentication open, which Support did and confirmed. Access worked both ways afterwards. I would assume that Support would have said something if this is about to change.
    – Jonas Lamberty
    May 11, 2020 at 11:48
  • Thanks @ Naveen VM and @Jonas Lamberty ,I have updated my question how I connect to my FTP and I am using SFTP as you can see.Will that suffice?
    – Chetan
    May 11, 2020 at 14:27
  • @Chetan if you have decided to go with SSH key then, you can just follow my answer.
    – Naveen VM
    May 11, 2020 at 14:44
  • @Naveen VM Ok If Salesforce says I need to start using SSH keys, what you are saying is I have to create an SSH key and then pass the public key to Salesforce support and distribute the private key with users.but is the distribution of private key to users and vendors safe?
    – Chetan
    May 11, 2020 at 15:00
  • The idea behind the whole public / private key setup is that what you refer to as your "user" is the only one that knows their own private key. So it would only really make sense if they handed only the public key to you / Salesforce. Everyone who's responded so far doubts this will have to be done though. At any rate, the "correct" way to do this would be that the user creates a key pair, and only the public key ever leaves his hands. If you are sending around private keys, indeed you should be asking yourself if that is making much sense.
    – Jonas Lamberty
    May 11, 2020 at 15:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .