Problem
We need to restrict users from uploading files with specific extensions.
Solution
- First create a user class, if we want to apply the upload restriction to specific users. If we want to apply the upload restrictions to all SecureTransport users, this step is not required.
- Next, go to Access > Restrictions, go to the Upload tab, and click the "New Entry" button. There you can specify the path/filename (for example, "/*.exe") that you want to restrict, set the Allowed field to No, and set the user class to which this should apply (or * for all). Then save it using the disk icon to the right.
Note that if you use certain SSH clients (such as WinSCP), they may transfer files with an added extension (such as ".filepart") to allow for restarts. In that case, you may have to add two rules, one for the base extension (such as .exe) and one for the additional extension (such as .exe.filepart).
https://support.axway.com/kb/100960/language/en
下面的例子实现的是允许用户通过webclient上传文件,并且只能上传后缀名为txt的文件。
Out of the box, you can do that for ALL protocols (you cannot allow that for FTP but stop it on HTTPS/SFTP for example).
If this is what you need, what you are looking for are the Upload Restrictions: (Access -> Restrictions -> Upload Restrictions) on the UI. If you want that to apply to everyone, you can leave the class as *. If not you will first need to put the users in a class (based on GID or username or IP address they are coming from) and then use the class in the rules.
The path is relative to the home folder (so if you want to stop them from uploading into a folder notPDF, you put "/notPDF" in the field.
Please note that the restrictions are case sensitive unless you are on ST 5.5 or higher patches of 5.4 where you can use the controls to make them case insensitive if you need them to be. And as the files are always allowed, you will need two rules - one to allow pdf, one to disallow *. The order of them will depend on the value of "Restrictions.OrderOfApplication" in Server configuration ("legacy" means applying rules from bottom to top so your order will be "allow pdf, deny all"; "new" applies the rules from top to bottom so your order will be "deny all, allow pdf"). Legacy is the default. In older servers (as you did not mention a version), legacy was the only way :)
https://docs.axway.com/bundle/SecureTransport_55_AdministratorGuide_allOS_en_HTML5/page/Content/AdministratorsGuide/access_control/t_st_uploadRestrictions.htm has a pretty good explanation of the fields and how to control the order of different lines but if you need help with the exact rules, let me know.
If you need to do that only for SFTP and HTTPS but still allow it for FTP(S), PESIT and so on, you will need a pluggable Authorization.