Add Cyberduck and Mountain Duck - App to the (macOS / Windows) CAP exit point and DPI

Endpoint Protector Endpoint Protector Ideas
, , , , ,
1

Which aspect of EPP are you submitting for?

Endpoint Protector Server

What is a one sentence summary of your feature request?

Add Cyberduck and Mountain Duck - App to the (macOS / Windows) CAP exit point and DPI.

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

Add Cyberduck and Mountain Duck (macOS and Windows) as natively recognized applications with protocol- and destination-level visibility (SFTP/FTPS/WebDAV/S3/Azure/GCS/B2 and cloud-drive connectors), so that file transfers through these multi-protocol clients can be logged and blocked per destination instead of the current all-or-nothing application block.

Cyberduck is one of the two most widely used free, open-source file transfer clients alongside FileZilla, available on both macOS and Windows and localized in more than 30 languages including Korean, which makes it common on developer and designer endpoints in Korea. Unlike a classic FTP client, a single Cyberduck installation connects to FTP, SFTP, FTPS, WebDAV, Amazon S3, Azure, Google Cloud Storage, and Backblaze B2, plus Google Drive, Dropbox, and OneDrive.

In other words, every cloud storage and file transfer channel that EPP controls as a separate application (browser upload, Dropbox client, OneDrive client, FTP client) is reachable from one unregistered binary. Mountain Duck, from the same developer, goes one step further: it mounts the same remote destinations as a local drive, so a copy to an S3 bucket or a personal SFTP server appears to the endpoint as an ordinary filesystem write.

How do you currently solve the challenges you have by not having this feature?

For Mountain Duck, the mounted-volume behavior bypasses application-level CAP control completely: the writing process is Finder/Explorer, not the transfer client, and the destination is a virtual drive rather than a recognized removable or network path.

And also Cyberduck, files dragged and dropped into the Cyberduck window (or uploaded through its “Upload” action) are transferred without any CAP inspection or log event, even when Cyberduck is registered as a custom application.

2

Hi @JeremyG,

I wanted to share a positive update. Support for Cyberduck and Mountain Duck as egress channels is already included in our product roadmap.

We have already made some initial progress, so please stay tuned for further updates.

BR, Krzysiek

1 Like
3

Hi Krzysiek,

Thank you for the positive update — it’s great to hear that Cyberduck and Mountain Duck support as egress channels is already on the roadmap and that initial progress has been made.

Since Cyberduck is quite common on developer and designer endpoints here in Korea, this will be a meaningful improvement for our customers.

As with the GitHub DPI request, if a test environment, real-world transfer samples across the different protocols (SFTP, S3, WebDAV, mounted volumes via Mountain Duck, etc.), or early testing would be useful at any stage, please feel free to reach out. I’ll do my best to help within whatever scope I’m able to.