Bypassing 2FA for FTP/SFTP/WebDAV Users

Site Administrators can allow FTP, SFTP, and WebDAV connections to skip the second factor while 2FA still applies to the web interface and the API. When this is enabled, affected user profiles gain an option to bypass 2FA for those protocols as part of configuring a 2FA method.

Bypassing 2FA on the protocols that cannot prompt for it is not the same as abandoning 2FA for the account. The account still gets challenged on the web interface and the API, which is where an attacker with a stolen password would go. That makes this a reasonable configuration rather than a last resort.

An account that authenticates with an SFTP/SSH key needs the bypass, because SFTP/SSH keys cannot authenticate an account that requires Files.com-managed 2FA. A counterparty locked to a third-party SFTP client may also have no workable second factor for that connection, and the bypass plus a strong credential beats a 2FA mandate they cannot satisfy.

Use a key rather than a password on any account you bypass. Removing the second factor leaves one credential protecting the connection, and an API key or SFTP/SSH key is far stronger than a password.

Using an API Key as the Password

For scripts and applications, an API key authenticates over FTP, SFTP, and WebDAV without any 2FA involvement. Set the login name to @api- followed by either the key's ID or the key's name, for example @api-5373469 or @api-botsync, and use the API key itself as the password.

This keeps the 2FA requirement intact for the human users on your site while letting automation sign in with a credential built for it. Creating a separate key per integration also means revoking one key stops one workflow rather than all of them.

Enabling the Bypass

The site-wide setting has to be enabled before a user configures their 2FA method, because the per-user option only appears during that setup. Users cannot edit a 2FA method after the fact, so for an account that has already enrolled, an Administrator resets the user's 2FA and the user sets it up again.

Enable the sitewide setting before you turn on a 2FA mandate, so the bypass option is available the first time each user configures 2FA. If the mandate goes first, those users enroll without it, and an Administrator has to reset each one so they can enroll again.

Enabling it early does not spare anyone the setup itself. A user who authenticates with a password or an SFTP/SSH key still cannot connect over these protocols until they finish configuring 2FA in the web app. To avoid interrupting protocol transfers at all, move those accounts to API keys or exempt them from the mandate first.