Kapstone Hardened SFTP + Control Panel

Function

OpenSSH-based SFTP with chrooted users, key authentication and per-user quotas, plus a web control panel and CLI for users, keys, quotas and cloud storage folders.

• Operates OpenSSH SFTP with each user chrooted to its own directory, key authentication by default, and per-user quotas.
• Includes the Kapstone Control Panel, a web interface for adding or disabling users, rotating keys, setting quotas and attaching cloud storage as folders. The panel is reached over an SSH tunnel by default; no additional ports are opened.
• Attaches Azure Blob Storage, Azure Files, Amazon S3 or Amazon EFS as folders within a user's SFTP home, so received files land in storage that downstream systems already read.
• Requires TOTP multi-factor authentication for panel administrators and records every administrative action in the audit log. A command-line interface with the same functions supports automation.

Intended use

Receipt of laboratory results, claims files, vendor uploads and partner data where the counterparty operates a standard SFTP client.

A printable one-page summary is available for procurement and security staff.

Components

SFTP service

OpenSSH; chrooted users; key authentication; quotas

Control panel

Web interface over SSH tunnel; no additional open ports

Cloud storage as folders

Azure Blob, Azure Files, Amazon S3, Amazon EFS

Administrator MFA

TOTP

Audit

All administrative actions logged

Automation

CLI with the same functions as the panel

Hardening

Baseline shared by every image

• AlmaLinux 9 with the DISA STIG profile applied; all exceptions documented
• FIPS mode enabled at installation; the operating system crypto policy restricts the system to FIPS 140-3 validated cryptographic modules
• SELinux in enforcing mode
• fapolicyd application allow-listing
• auditd configured with the STIG audit rule set
• Authentication by customer-supplied SSH keys only (RSA; ed25519 keys are rejected under FIPS mode)
• Monthly rebuilds with current security updates

Each control is explained on the Compliance page.

Evidence

Documentation issued with every release

• Built on the hardened AlmaLinux 9 base; inherits its evidence pack
• Key-only authentication; password authentication disabled
• Administrator MFA and complete administrative audit trail
• No inbound ports beyond SSH

OpenSCAP scan results

Automated STIG scan output from the exact build deployed.

DISA-format .ckl checklist

Opens in DISA STIG Viewer and can be provided directly to an assessor or ISSO.

SBOM (CycloneDX)

A software bill of materials listing every package and version on the image.

Documented exceptions list

Each open STIG item, the reason it remains open, and the mitigating control. Suitable as POA&M input.

Acquisition

Marketplace listing, free trial and private offers

Free trial: one month on Azure, 30 days on AWS. The software fee is waived; the customer pays the cloud provider for the virtual machine. See Pricing.

Specifications