Blog

FTP OTP Authorization

A one-time password (OTP) is a temporary, unique code used for additional authentication. It is typically sent via SMS or email, or generated by an authentication app, and is valid for a short period of time (usually between 60 and 180 seconds) or for a single login attempt. Time-limited OTPs are known as ‘TOTP’ and single login OTPs are known as ‘HOTP’.

FTP OTP is a security feature of a FTP server that adds an extra layer of protection by requiring an OTP in addition to the usual username and password. This prevents unauthorized access, even if the main credentials (i.e., username and password) have been compromised.

Before enabling the OTP feature with AnyFileBackup, please verify that the destination FTP server supports OTP in a non-interactive mode.

To enable FTP OPT with AnyFileBackup, please open the FTP account settings (‘Settings’ > ‘Accounts’ > ‘FTP’) and do the following

[1] Check the checkbox next to ‘Enable OTP’

[2] Press the ‘Configure’ button and configure the OTP in the opened window:

TOTP seed: a secret key based on which the OTP is generated (usually, it looks like this: 1abc 2def 3ghi 4jkl 5mno 6pqr 7stu 8vwx);

Interval: determines the time period during which the OTP will be valid;

TOTP format: the length of the TOTP key which may be 6, 7, or 8 digits;

Usage template: a request string which AnyFileBackup provides to the FTP server and which may have various formats, examples include (use without the double quotes and the end colon):

  • “${PASSWORD}${OTP}”: combines a TOTP password with a regular FTP account password;
  • “${PASSWORD};${TOTP}”: combines a TOTP password with a regular FTP account password separated by a semicolon;
  • “${TOTP}”: use a TOTP password as a regular FTP account password;
  • Custom configuration: you may use other combinations of ${PASSWORD}, ${TOTP}, and other symbols are may be required by a particular FTP server.

Note that AnyFileBackup-generated OTPs:

(a) are the same as may be generated by Google Authenticator or any comparable authenticator;

(b) are TOTPs only, not HOTPs;

(c) are not designed for Web client interactive login where a user is requested to manually enter TOTP into a browser.

<< Go back to the previous page