Illizeo can deposit files on an SFTP server of your company: scheduled reports, payroll outputs, file exchanges with the payroll software. This server is set up once, for all these uses, on a dedicated page. This article explains how to enter it, test it, check its identity and replace it. It is for administrators, with the help of your IT department.
Before you start #
- The page is under Settings › Manage Illizeo › SFTP server. It requires the “Export — Configure (fields/format)” permission: at the Access level to read it, at the Execute level to save, test, remove or accept a fingerprint. By default, only the Administrator role holds it; it is set in Settings › Manage Employees › Employee Roles (see Permissions & roles).
- No subscription option is needed.
- Ask your IT department for: the server name or address, its port, an account dedicated to Illizeo with a password or a private key, the deposit folder, and the fingerprint of the server key so you can compare it.
- The server must be reachable from the internet: Illizeo refuses to connect to an internal network address.
Entering the server #
- Open Settings › Manage Illizeo › SFTP server.
- Host: the server name or address, for example
sftp.example.com. - Port: 22 by default.
- Username: the login account.
- Password, or Private key (optional): one of the two is required. Paste the whole key, in OpenSSH format (it starts with
-----BEGIN OPENSSH PRIVATE KEY-----); Illizeo does not ask for a passphrase, so use a key that has none. If you fill in both, the key is used. - Remote folder: the folder to deposit into, for example
/exports. Left empty, files go to the account’s home folder. - Click Save. The button stays greyed out until the host and username are filled in.
The password and key are encrypted and never shown again: once saved, their fields stay empty with the mention “(unchanged)”. Leave them empty to keep the saved ones; changing the host requires entering them again.
Testing the connection #
The Test connection button checks what is currently entered, completed by the saved secrets if their fields are empty. It does not save the entry and deposits no file; only the first successful test of the saved server records its key fingerprint (see below). It checks, in order, that the address is not internal and that it exists, that the server answers, that it presents the expected key, that the account is accepted and that the remote folder exists. The result is shown next to the buttons, in green for a successful connection, in red with the reason otherwise:
| Cause | What to check |
|---|---|
| Host or username missing | Both fields are required. |
| Internal network address | The server must be exposed on the internet; Illizeo does not connect to an internal network. |
| Host not found | The spelling of the name, or its DNS record. |
| Connection failed | The host and port, and that your firewall accepts connections from Illizeo. |
| Server key changed | See “The server’s identity” below. |
| Authentication refused | The username, password or key. |
| Connection successful, remote path not found | Does the remote folder exist, and can the account access it? |
The server’s identity #
So that no intermediary can impersonate your server and receive your files, Illizeo records the fingerprint of its key at the first successful contact (first test or first deposit). The Server identity section, below the form, shows it after Pinned fingerprint, or says it is not pinned yet. Compare it with the one given by your IT department.
From then on, any connection where the server presents another key is refused before any credentials are sent, and nothing more goes out. The section announces it in red, with the Recorded and the Presented fingerprints. Either the server was replaced, or someone is impersonating it:
- Have your IT department confirm the new fingerprint.
- Tick Our IT team confirmed this fingerprint.
- Click Accept the new fingerprint.
Illizeo contacts the server again before accepting: if it now presents a key other than the one displayed, acceptance is refused and the test must be run again. When a scheduled deposit runs into a changed key, the people entitled to accept the fingerprint receive a notification in the bell and by email.
Changing or removing the server #
- Saving another host or another port means changing server: the recorded fingerprint is forgotten and will be taken again at the first contact with the new one.
- The Remove button removes the server at once, without a confirmation step. Deposits that rely on it then fail until a server is set up again.
Good to know #
- A report schedule can use a server other than the company’s; it then has its own credentials and its own fingerprint (see Scheduling a report).
- What is deposited on this server, and where to follow each deposit, is described in SFTP deposits and how to track them.
FAQ #
The test succeeds, but nothing arrives on the server. #
The test deposits no file. Check that a use is set up to deposit (a schedule on the SFTP deposit channel, a payroll output ticked…) and look at its tracking.
I need to change the account password. #
Enter the new one in Password, test, then save. The other fields stay as they are.
