SFTP Multi-Region Support and Host Key Migration

Paxos is introducing a multi-region architecture to increase the resiliency of our SFTP service. In Phase 1, you should connect to the new "west" endpoint to support a passive failover. There will be no changes to your existing "east" connection. Bi-directional file replication is enabled between regions; full historical data synchronization will complete by Phase 2. There are no changes to your existing "east" connection hostname, username, SSH key, allowlisted source IP addresses or directory structure.

In Phase 2, there will be a breaking change where we will add the same "west" host key to the "east" endpoint to enable a seamless failover for customers. After this change, both sftp.sandbox.paxos.com and sftp.paxos.com can point to either the existing ("east") or new ("west") IP addresses.

Phase 1: Prepare and test (action required)

In this phase, customers can validate connectivity to the "west" endpoint and upgrade your client without affecting your live "east" connection. Note that if you currently use absolute folder paths, you must update your configuration to use relative paths.

Actions required from you, in both Sandbox and Prod:

1. Allowlist the new "west" destination IP addresses in your firewall / routing table.

2. Add the new host key to your known_hosts file for the "west" hostname. If your users connect through an SFTP client, ensure they are instructed to verify and accept the new host key when prompted.

3. Add the same host key to the known_hosts for the "east" configs to prepare for a seamless failover in Phase 2. This will not affect your existing "east" connection.

4. Upgrade your SFTP client and layered components to the latest versions to ensure support for ED25519 host keys.

5. Connect to the "west" endpoint on the connectivity start dates below and confirm a successful login.

6. Upload a test file and delete it to verify your permissions remain intact.

7. Verify all test files you upload are deleted from both the "west" and "east" endpoints to minimize any impact to your environment.

Sandbox "west" connectivity details

Prod "west" connectivity details

Phase 2: Regional failover enablement

Once you have added the same new host key to both the "east" and "west" hostnames in your known_host config, and allowlisted both regions' IP addresses in Phase 1, a failover initiated by Paxos in this phase should not require any changes on your end.

Please note that starting Nov 30, 2026 (Sandbox) and Dec 7, 2026 (Prod), Paxos will failover from "east" to "west" IP addresses, and will retire the old RSA-2048 key. Customers who fail to add the ED25519 host key to their known_hosts file in Phase 1 will likely see connection failures due to a host key mismatch. You may choose to add the new host key after the "east" to "west" failover, but should do so promptly to minimize impact to your SFTP batch jobs.

Note: SFTP is a stateful protocol so active transfers may be interrupted during failover. Please ensure your client automatically retries failed transfers so that a failover does not result in a missed file.

Appendix: How to Verify and Save the Host Key

You can fetch the new host key directly from the endpoint and verify it against the fingerprints in the tables above before you trust it. Run these from a machine that can reach the endpoint.

Fetch the remote host key in known_hosts format:

# Sandbox
ssh-keyscan -t ed25519 sftp-west.sandbox.paxos.com

# Prod
ssh-keyscan -t ed25519 sftp-west.paxos.com

Compute the SHA256 fingerprint (default) and the MD5 fingerprint of the fetched key, and compare them to the fingerprints provided in your migration email notification:

# SHA256 (Prod shown; swap the hostname for Sandbox)
ssh-keyscan -t ed25519 sftp-west.paxos.com | ssh-keygen -E sha256 -lf -

# MD5
ssh-keyscan -t ed25519 sftp-west.paxos.com | ssh-keygen -l -E md5 -f -

Here is the expected output:

# Sandbox (sftp-west.sandbox.paxos.com)
256 SHA256:/xp6Hed0Hf19SAuD4IKxBXONjZHS4AnseiMDKZeh700 sftp-west.sandbox.paxos.com (ED25519)
256 MD5:a6:9d:45:e9:0b:38:47:3e:15:6f:36:75:d5:68:99:0f sftp-west.sandbox.paxos.com (ED25519)

# Prod (sftp-west.paxos.com)
256 SHA256:kyF/9t4o3MHdfZAi7p9GFjVDBx9BUMwi8O1oJHDY3yc sftp-west.paxos.com (ED25519)
256 MD5:43:1c:86:38:79:0d:2e:f9:75:fe:9a:11:7f:14:a7:44 sftp-west.paxos.com (ED25519)

Once the fingerprints match, add the key to your known_hosts file for both the "west" and "east" hostnames. Each entry is a single line, with the hostname followed by the key (replace the placeholder with the verified key from your email notification). Example entries:

# Sandbox
sftp-west.sandbox.paxos.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHwWJAsxwx2xBzs5stokygxohSbolI9TlwtY/DdlZQg
sftp.sandbox.paxos.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHwWJAsxwx2xBzs5stokygxohSbolI9TlwtY/DdlZQg

# Prod
sftp-west.paxos.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID24q19p7yBC/kUd8ETLsPWLSrxL/QmYGI2saShfZP4t
sftp.paxos.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID24q19p7yBC/kUd8ETLsPWLSrxL/QmYGI2saShfZP4t

If you have any questions, please reach out to your Technical Account Manager or contact our Support team.