blog posts

After entering your password (or using an SSH key), you’ll enter an interactive SFTP session where you can use commands like put, get, ls, and cd to interact with the remote system.

For example, to upload a file from your local machine to the remote server:

put localfile.txt /remote/directory/

And to download a file:

get /remote/directory/file.txt

This makes SFTP handy for quick, secure file transfers without a complete GUI.

Secure Authentication with SSH Keys

Using SSH key pairs is a more secure way of authenticating users than relying on passwords. Here’s how to generate a key pair and configure it for use with SFTP:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

Once the key pair is generated, copy the public key to your server:

ssh-copy-id username@yourserver.com

After this, you can log in using your private key, and optionally turn off password-based login on the server for added security.

In server configuration, typically in /etc/ssh/sshd_configYou can enforce key-only login:

PasswordAuthentication no

Make sure to restart the SSH service after editing the configuration.

SFTP Automation Using Python (with Paramiko)

For developers, automation is key. Using the paramiko library in Python, you can automate SFTP uploads, backups, or monitoring tasks:

import paramiko

host = "yourserver.com"
port = 22
username = "youruser"
private_key_path = "/path/to/private/key"

key = paramiko.RSAKey.from_private_key_file(private_key_path)
transport = paramiko.Transport((host, port))
transport.connect(username=username, pkey=key)

sftp = paramiko.SFTPClient.from_transport(transport)
sftp.put("local_file.txt", "/remote/path/local_file.txt")
sftp.get("/remote/path/remote_file.txt", "remote_file.txt")

sftp.close()
transport.close()

This script establishes a secure connection using an SSH key, uploads one file, and downloads another. Such scripts are useful for automated backups or file synchronization between systems.

Comparing SFTP to FTP and FTPS

Despite being widely used historically, FTP transmits data, including login credentials, in cleartext. This is a significant security risk, especially on open networks. FTPS, the “secure” version of FTP, uses TLS/SSL encryption but requires multiple ports and complex firewall configurations. Moreover, FTPS isn’t universally supported, especially by minimal Linux servers.

SFTP solves all these problems by encapsulating everything over a single port with SSH encryption. This dramatically reduces the attack surface and makes the configuration much easier.

Use Cases Across Industries

SFTP is widely used in the financial industry to send reports and transactions securely between banks and partners. In healthcare, it helps transmit sensitive patient records in compliance with HIPAA. Governments and legal firms rely on SFTP to handle confidential documentation.

E-commerce companies use SFTP to exchange inventory files and billing data with their logistics and accounting platforms. Software development teams use SFTP in CI/CD pipelines to deploy applications, upload builds, or fetch logs from staging or production servers.

Graphical Tools for SFTP Access

While command-line tools are powerful, not all users are comfortable with them. GUI-based tools like FileZilla, Cyberduck, and WinSCP provide a drag-and-drop interface with SFTP support. These tools are ideal for beginners or office staff who need to transfer files securely without knowing terminal commands.

For example, in FileZilla, set the protocol to “SFTP—SSH File Transfer Protocol” and log in using your hostname, username, password, or SSH key. You can transfer files as easily as copying between folders on your desktop.

Server-Side Best Practices

When hosting your SFTP server, consider chrooting users to their home directories to prevent them from navigating into sensitive filesystem parts. You can configure this using OpenSSH’s sshd_config:

Subsystem sftp internal-sftp

Match User sftpuser
    ChrootDirectory /home/sftpuser
    ForceCommand internal-sftp
    AllowTcpForwarding no

/var/log/auth.log