How to set up an SFTP server on Windows and Linux (OpenSSH)

1. 1

   Step 1: Add OpenSSH Server

   Open Settings > System > Optional features (on Windows 10, Apps > Optional features), choose View features or Add a feature, and add OpenSSH Server. Or in PowerShell as administrator:

   Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*'
   Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

2. 2

   Step 2: Start sshd, now and at every boot

   Start-Service sshd
   Set-Service -Name sshd -StartupType Automatic

3. 3

   Step 3: Check the firewall rule

   Installing it adds a rule for port 22. Check it's there and on:

   Get-NetFirewallRule -Name *OpenSSH-Server* | Select-Object Name, Enabled
   # If it's missing:
   New-NetFirewallRule -Name sshd -DisplayName "OpenSSH Server (sshd)" -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow

4. 4

   Step 4: Connect

   From another computer, sftp yourname@windows-pc with your Windows user name and password. You start in your user folder. The server's settings are in C:\ProgramData\ssh\sshd_config; run Restart-Service sshd after changing them.

Install OpenSSH Server, start it now and at boot, and allow SSH in the firewall:

# Ubuntu and Debian
sudo apt update && sudo apt install -y openssh-server
sudo systemctl enable --now ssh
sudo ufw allow OpenSSH

# Fedora, RHEL, Rocky Linux and AlmaLinux
sudo dnf install -y openssh-server
sudo systemctl enable --now sshd
sudo firewall-cmd --permanent --add-service=ssh && sudo firewall-cmd --reload

SFTP is on by default. To check, look for the Subsystem sftp line in /etc/ssh/sshd_config; if it's commented out, remove the # and restart SSH. For the details of turning SSH on, including on a Raspberry Pi and Ubuntu's newer socket activation, see how to enable SSH on Ubuntu and Debian.

For people who only need to upload and download, such as a customer, a scanner or a backup job, lock their account to SFTP inside a folder of its own. On Linux, make a group for them and an account with no shell:

sudo groupadd sftponly
sudo useradd -m -G sftponly -s /usr/sbin/nologin uploader
sudo passwd uploader

Add this at the end of /etc/ssh/sshd_config:

Match Group sftponly
    ChrootDirectory /srv/sftp/%u
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

The folder they're locked into must belong to root and not be writable by anyone else, so give them a folder inside it to write to, then check the settings and restart SSH:

sudo mkdir -p /srv/sftp/uploader/files
sudo chown root:root /srv/sftp/uploader
sudo chmod 755 /srv/sftp/uploader
sudo chown uploader:uploader /srv/sftp/uploader/files
sudo sshd -t && sudo systemctl restart ssh     # sshd on Fedora and RHEL

On Windows, the same idea works for SFTP sessions. Add this at the end of C:\ProgramData\ssh\sshd_config:

Match User uploader
    ChrootDirectory C:\SFTP\uploader
    ForceCommand internal-sftp
    AllowTcpForwarding no

Then Restart-Service sshd. Give the user write access only to a folder inside it, for example with icacls C:\SFTP\uploader\files /grant "uploader:(OI)(CI)M".

• Sign in with keys, and turn password sign-in off for everyone who can use keys: passwordless SSH with keys.
• Give each person their own account, so you can remove one without changing everyone's password.
• Keep the server updated. Moving it off port 22 cuts down noise in the logs but isn't protection on its own: the SSH port.
• Don't forward port 22 on your router unless you have to. On a home or office network, RemoteAccessApp can reach the server through one of your own PCs there instead.

In the RemoteAccessApp Console, add the server on Connections as an SFTP host (or as an SSH host and click Files). The first time, you see the server's key fingerprint and choose whether to trust it. Its files open next to your PC's in two panes, with drag and drop both ways, and you can copy straight from one server to another. Free on Windows and Linux for up to 5 saved hosts: download RemoteAccessApp. Comparing clients first? Use the SSH client checklist.