How to use SFTP: commands and file transfers over SSH

SFTP is part of SSH. It uses the SSH connection, so it's encrypted, it runs on the SSH port (22 unless the server uses another SSH port), and it signs in with the same accounts, passwords and keys. Any server you can reach with ssh almost always takes sftp too: the SSH server on Linux, macOS and Windows includes it.

Despite the name, it isn't FTP. FTP is an older, unencrypted protocol on port 21, and FTPS is FTP with TLS added. If you have the choice, use SFTP. Don't have an SSH server yet? Enable SSH on Ubuntu or Debian first.

1. 1

   Step 1: Connect

   In a terminal (or PowerShell on Windows), start in the folder where you want downloads to land, then connect:

   sftp admin@server.example.com
   sftp -P 2222 admin@server.example.com              # another port: capital P
   sftp -i ~/.ssh/id_ed25519 admin@server.example.com # a specific key

   The first time, check the server's key fingerprint before you type yes, as with ssh. The prompt changes to sftp>. An old NAS or device that answers with "Unable to negotiate" needs the fix for no matching host key type found.

2. 2

   Step 2: Find the folder on the server

   pwd shows where you are, ls -l what's there, and cd /var/www/site moves you.

3. 3

   Step 3: Pick the folder on your computer

   The same commands with an l in front work on your side: lpwd, lls and lcd ~/Downloads.

4. 4

   Step 4: Upload with put

   put report.pdf uploads one file, put -r photos a whole folder (with older sftp versions, make the folder on the server first with mkdir photos).

5. 5

   Step 5: Download with get

   get backup.tar.gz downloads a file, get -r logs a folder. If a big download is cut off, reconnect and reget backup.tar.gz carries on where it stopped.

6. 6

   Step 6: Close the session

   Type exit.

Everything you'll use day to day. Commands without an l work on the server; with an l in front, on your computer.

You don't always need the interactive prompt:

# download one file to the current folder
sftp admin@server.example.com:/var/log/syslog

# run a list of commands from a file
sftp -b upload.txt admin@server.example.com

A batch file is just sftp commands, one per line (for example cd /var/www/site then put -r dist/*). Batch mode can't ask for a password, so set up key sign-in first. A server you've saved in your SSH config file works by its short name: sftp web.

scp report.pdf admin@server.example.com:/tmp/
scp admin@server.example.com:/var/log/syslog ./
scp -r photos admin@server.example.com:backup/
rsync -avz --progress site/ admin@server.example.com:/var/www/site/

With rsync, the slash at the end of site/ matters: it copies what's inside the folder rather than the folder itself. Copying between two servers rather than to your own computer? See how to copy files between two servers.

Commands are quick once you know them, but for browsing, dragging is easier. The RemoteAccessApp SSH and SFTP client has a free two-pane file manager in its Console for Windows and Linux:

• Open a server's files: add the server on Connections as an SFTP host, or click Files on a saved SSH host or above its terminal.
• Two panes: This PC on one side, the server on the other. Drag files between them, or select them and click Upload or Download.
• No surprises: you're asked Replace existing items? before anything is overwritten, and the Transfers list shows each file, with the reason if one fails.
• The same server key check and password or key sign-in as the SSH terminal. FTP and FTPS servers open in the same file manager.

It's free for up to 5 saved hosts: download RemoteAccessApp. The help article on copying files with SFTP and FTP covers every button.

To let a user upload files without a shell, lock their account to SFTP in a folder of its own. Add this at the end of /etc/ssh/sshd_config:

Match User uploader
    ForceCommand internal-sftp
    ChrootDirectory /srv/sftp/uploader
    AllowTcpForwarding no
    X11Forwarding no

The folder they're locked into must belong to root and not be writable by anyone else, so give them a folder inside it to write to:

sudo mkdir -p /srv/sftp/uploader/files
sudo chown root:root /srv/sftp/uploader
sudo chmod 755 /srv/sftp/uploader
sudo chown uploader:uploader /srv/sftp/uploader/files
sudo sshd -t && sudo systemctl restart ssh     # sshd on Fedora and RHEL