How to set up sFTP for using certificate auhtentication on Linux

Question

Accepted Answer

Overview

These instructions apply to users who are receiving their statements via sFTP. If you elected to receive your statements via sFTP, you would first need to generate a RSA/ECDSA/EDDSA Key pair.

There are many Linux distributions and there are multiple methods to access our sFTP server. sFTP clients such as FileZilla can be used. In this article we explain how to realize the connection to our sFTP server using Ubuntu Linux and Filezilla.

How to generate an RSA Key pair

On your Linux machine, click on the Applications icon in the bottom left corner of you screen.
In the search box, type terminal and then click on the Terminal icon in the search results.
In the Terminal window, type sudo apt-get install filezilla putty-tools in order to install the required software. Enter your sudo password when requested.

Once the software installation is complete, type one of the commands below, according to the type of key that you want to create, and then press Enter on your keyboard

Type of Key	Command to type in the Terminal
RSA 2048-bit	puttygen -t rsa -b 2048 -o privatekey.ppk
ECDSA (nistp256)	puttygen -t ecdsa -b 256 -o privatekey.ppk
ECDSA (nistp384)	puttygen -t ecdsa -b 384 -o privatekey.ppk
ECDSA (nistp521)	puttygen -t ecdsa -b 521 -o privatekey.ppk
EDDSA (ed25519)	puttygen -t ed25519 -o privatekey.ppk

Note: all the above key types are supported by our system. You can choose the one of your preference

Type puttygen -L privatekey.ppk -o public.key in order to export the public part of the Key pair to the file public.key
Click on the Applications icon in the bottom left corner of your screen.
In the search box, type FileZilla and then click on the FileZilla icon in the search results.
Click on the FileZilla top menu File -> Site Manager...
In the Site Manager window, click on the button New site to create a new connection.
In the right panel (called General):
1. Select SFTP - SSH File Transfer Protocol as Protocol
2. Enter ftp2.interactivebrokers.com in the Host field
3. Enter 22 in the Port field
4. Select Key file as Logon Type
5. Enter the username provided to you by us in the User field
Click on Browse next to the Key file field.
Move to the folder where your Key pair was created (normally your user folder:/users/yourusername/). Select the file privatekey.ppk and click on the Open button. This will set it as the Key file in your connection parameters.
Click on Rename and select a name of your preference for this connection (e.g. IBKR sFTP). Press Enter to confirm the name.
Click on OK to save your connection parameters.
Click on the folder icon on the left hand toolbar of your Desktop. This will launch the File application.
Move to the folder where you saved your Key pair (normally your user folder:/users/yourusername/). Right click on the file public.key and select Send to...

The file will be attached to an empty email. Send the email to the File Delivery Team, as per Using PGP/RSA encryption keys to guarantee the privacy and security of your reports.

Important Note: attach only your public key file , nothing else. We will not accept your public key if your private key is included.

How to connect to our sFTP Server

Once we have configured the parameters for your connection on our servers, you will be notified. After that, you will be able to access your sFTP repository by using the Site connection you have created in FileZilla. In case you have not yet set up a Site connection, please follow the steps from 6 to 14 which are a prerequisite to the below steps:

Click on the Applications icon in the bottom left corner of you screen
In the search box, type FileZilla and then click on the FileZilla icon in the search results.
On the FileZilla top toolbar, click the down arrow icon and select the Site connection you previously created (e.g.IBKR sFTP)
FileZilla will now establish a connection to our sFTP Server and show the files present in your repository.

Common issues and solutions

The Login Credentials Provided are Incorrect

Ensure the correct login details are being used to connect to the sFTP server. The username and password you are entering should match the ones you have received from the File Delivery Team.
Confirm you have configured your sFTP Client to use the Private Key file for the logon authentication (see steps 9. and 10. of the above procedure.)

Server Refused Our Key

Try accessing the sFTP server using a different Client (CyberDuck, ect.)
Ensure the Private Key file being used to Authenticate the server login attempt is related to the Public Key you originally sent to the File Delivery Team Integration Team.
Should the above checks be unable to resolve the issue, please generate a new RSA/ECDSA/EDDSA Public/Private Key and send only the Public part to the File Delivery Team, as per Using PGP/RSA encryption keys to guarantee the privacy and security of your reports.

Connection Timed Out

In case you have an antivirus or a security software installed on your machine, make sure it is not blocking the sFTP connection attempt. Normally, security software allows to set up exceptions for specific connections in order to whitelist them.
Verify that the public IP Address of the machine running the sFTP client, is the same you have originally provided to the File Delivery Team Integration Team for being whitelisted. You can discover your public IP Address by searching the Internet for "what is my IP". If your current IP Address is not the same you provided to us, please send it to our File Delivery Team, for being whitelisted.
Ask your network administrator/s to confirm that your firewall allows both incoming and outgoing traffic from/to ftp2.interactivebrokers.com on port TCP 22.
Should the above steps be unable to resolve the issue, please generate a new RSA/ECDSA/EDDSA Public/Private Key and send only the new Public part to our File Delivery Team, as per Using PGP/RSA encryption keys to guarantee the privacy and security of your reports.

Additional Information