File transfer, clipboard and RDP security in Remote Access

This page is for administrators who decide what may move in and out of a remote session, and for anyone who wants to know what SSOGEN allows per protocol. Setting a resource up is covered in Remote Access to SSH, RDP and VNC hosts.

Who can do this. A Super admin or an Application admin. Other roles see the settings but cannot change them.

What is needed first. A saved Remote Access resource. For a capability granted With approval, the resource must use just-in-time access (see Approvals and access windows).

The result. People who open the resource can paste into the host, copy out of it, upload files or download files, exactly as far as you allow, and every use is recorded.

The examples use the fictional company Acme Corp and a server called Acme Build Server (SSH).

What each protocol allows

Everything is off for a new resource. Each of the four capabilities is one direction of one kind of data, and is turned on separately, with a reason.

Capability	SSH	RDP	VNC
Paste from your computer into the host (clipboard, into the host)	No (“Not available on SSH hosts.”)	Yes	Yes, text only
Copy from the host to your computer (clipboard, out of the host)	No	Yes	Yes, text only
Upload files to the host	Yes	Yes	No (“Not available on VNC hosts.”)
Download files from the host	Yes	Yes	No

Nothing else leaves a session: port forwarding and drive, printer and USB redirection are not offered. On an SSH host there is no clipboard capability to switch: the terminal takes typed and pasted text as keystrokes, and a paste of more than one line asks for confirmation first.

Turn a capability on

In the Admin Console, choose Secure access > Remote Access and open the resource.
Open the Access tab and scroll to Capabilities. It says: “Everything here is off unless you turn it on. Each one asks for a reason, which is recorded.”
On the capability you want, select Change. A dialog opens, titled Turn on: followed by the capability’s name, and states the risk, for example “People can take files from this host to their own computer.”
Fill it in:

Field	What to choose
Direction	Shown for information: “Into the host (from the person’s computer)” or “Out of the host (to the person’s computer)”.
Grant mode	Standing: everyone who may open it gives it to every session. With approval: asked for in the request lets a person tick it in their access request, and the approver decides. The dialog notes “With approval needs just-in-time access.”
Largest file (MB)	Asked the first time a file capability is turned on for this resource. Default 100. “A transfer larger than this is refused. 1 to 2048 MB.”
Why this host needs it (required)	“At least 10 characters. It is recorded in the audit log.” Up to 500 characters.

Select Save. The page says “Capabilities saved.” and the capability now reads, for example, “Download files from the host · Standing · turned on by Pat Chen 2026-11-09”, with “Reason:” and your text beneath.

Turn a capability off

On the capability, select Change. The dialog Turn off: says “It stops being available on the next session, even for a request that already approved it.”
Enter Why you are turning it off (required) and select Turn off.

A session that is already open keeps what it had until it ends.

What a session gets

A session has a capability only when all three agree: the resource has it on, the person’s access carries it (standing, or approved in their request), and the protocol supports it. The session page shows the result in one line under the status, for example Copy to your computer allowed · Paste into the host allowed · Upload allowed · Download allowed; anything not listed is off. Every clipboard and file action is checked by the Gateway against that set and against the size limits, and an attempt to use something that is off is recorded on the session’s timeline as Blocked: not allowed for this session. The session goes on.

Size limits

What	Limit
One file, up or down	Largest file (MB) of the resource, 1 to 2048 MB (default 100). A larger file is refused with “A file was larger than this session allows, so it was not transferred. The session goes on.”
One clipboard text, either direction	65,536 bytes. Longer text is not moved: “The clipboard text was too long for this session, so it was not copied. The session goes on.”
A file name	At most 255 characters: “That file’s name is too long (255 characters at most), so it was not uploaded. The session goes on.”
Transfers at once	One upload and one download at a time per session; further uploads wait in the list.
Folder listing (SSH)	The first 1,000 entries; the panel then says “Only the first entries are shown.”

The clipboard limit is fixed; the console offers no setting for it.

How it works per protocol

SSH: files over SFTP

The Files section of the session menu shows Folder: and the folder’s entries. Folders are links; each file has a Download button. The listing starts in the account’s home folder on the host.
Choose files (or dropping files on the panel) uploads into the folder shown. During the upload the file exists on the host under its name with .ssogen-partial added, and is renamed when complete. An existing file is never replaced: an upload with the name of a file that is already there is refused (“An upload was refused: a file with that name may already exist in the folder, the host account cannot write there, or another upload is running. The session goes on.”).
If a session is cut off mid-upload, the partial file stays. SSOGEN removes partial files older than 24 hours when a later session that may upload starts; the timeline then shows Unfinished upload files removed. If a partial file could not be removed, the person sees “An unfinished upload could not be removed: a file ending in .ssogen-partial remains on the host. The session goes on.”
The boundary is the host account’s permissions. The console says it plainly: “On SSH hosts, the host account’s permissions are the boundary: a symbolic link on the host can lead outside the SFTP root, for uploads, downloads and listings. For a hard boundary, use a dedicated file-transfer-only account confined with ChrootDirectory and ForceCommand internal-sftp in the host’s sshd_config; that account has no terminal.”

RDP: one redirected drive and the clipboard

With a file capability on, the Windows desktop sees one extra drive named SSOGEN Transfer. Files a person uploads appear at the root of that drive, read-only to the host.
With Download files from the host on, the drive has one folder, Download. A file the host saves there is sent to the person’s browser when it is closed, and then leaves the drive. Without the download capability the folder does not exist.
The clipboard is opened only in the directions the session has.

VNC: text clipboard only

The clipboard carries plain text in the Latin-1 character set. Characters outside it are dropped and the person is told: “Some characters were not pasted: this host’s clipboard carries only Latin-1 text.”
Text from the host that exceeds the limit is dropped whole and reported. VNC has no file transfer.

What people see

In the session, Session menu (or Ctrl+Alt+Shift, which is never sent to the host) opens a panel with the sections Clipboard and Files.

Clipboard: text copied on the host appears in the box, hidden until the box is selected (“Content hidden until you select this box”). Copy to my computer puts it on the person’s own clipboard; nothing from the host reaches their clipboard without that click. To send text, type or paste it in the box and select Send to host. When a direction is off the panel says “Sending text to the host is not allowed for this session.” or “Copying from the host is not allowed for this session.” Pasting more than one line into an SSH terminal asks first: “This paste has more than one line, so it would run as soon as it lands.” with Paste anyway.
Files: “Drop files here to upload them to the host, or” Choose files. Each transfer is listed as Upload or Download with Waiting, In progress, Done, Canceled, Refused, Too large or Could not be read, a progress bar and Cancel. When a direction is off: “Uploading is not allowed for this session.” or “Downloading is not allowed for this session.”

What is recorded

Each use is one row on the session’s and the resource’s Timeline: Clipboard used or File transferred, with “Direction: Into the host” or “Out of the host”, “Items:”, “Size:”, for a file the first characters of its SHA-256 digest, and “Outcome: Completed”, “Canceled”, “Refused” or “Too large”. The text, the file contents and the file name are never recorded. Turning a capability on or off is recorded as Capability settings changed with your reason. See Remote Access session audit.

Check it worked

Open the resource from My Apps as a person who may use it. The line under the status names the capabilities you turned on, for example Upload allowed · Download allowed.
Open Session menu > Files, upload a small file, and see it reach Done; on SSH it appears in the folder listing under its name.
Back in the console, the session’s Timeline has a File transferred row with “Direction: Into the host” and “Outcome: Completed”.

Troubleshooting

What you see	What it means	What to do
“Say why this host needs it, in at least 10 characters.”	The reason is too short.	Write at least 10 characters.
“Clipboard is not available on SSH hosts.” / “File transfer is not available on VNC hosts.”	The protocol has no such channel.	Nothing to do; see the table at the top.
“Approval only applies to just-in-time access. Make this resource just in time first, or choose Standing.”	With approval needs a just-in-time resource.	Change How access is granted on the Access tab, or choose Standing.
“Largest file: a whole number of megabytes from 1 to 2048.”	The limit is out of range.	Enter 1 to 2048.
“This resource changed since you opened it. It has been reloaded; make the change again.”	Another administrator saved the resource meanwhile.	Make your change again on the reloaded page.
“The capabilities could not be saved.”	The save failed.	Try again; reload the page if it repeats.
“Your role can view this but not change it.”	Your role lacks the right to change capabilities.	Ask a Super admin or Application admin.
A person sees “That action is not available in this session. The session goes on.”	The session does not carry that capability: it is off, not approved for this request, or not supported by the protocol.	Check the resource’s Capabilities and, for With approval, what the approver granted (“Approved with:” on the Requests tab).
“An upload was refused: a file with that name may already exist in the folder, the host account cannot write there, or another upload is running. The session goes on.”	SSOGEN never overwrites a file on the host, the account lacks write permission, or an upload is already running.	Rename the file, choose another folder, or wait for the running upload.
“The host did not accept that clipboard or file action. The session goes on.”	The host refused it.	Check the host account’s permissions.
“The file could not be saved on this computer. The session goes on.”	The browser could not save the download.	Check the browser’s download settings and free space.