SFTP Explained: Secure File Transfers on Linux

Command of the Day

sftp -P 22 user@server_ip

What it does: Initiates an interactive, encrypted SFTP session to browse, upload, and download files on a remote Linux server.

When transferring files to and from a web or game server, security is paramount. Legacy FTP (File Transfer Protocol) transmits passwords and data in plain text across the network. SFTP (SSH File Transfer Protocol) resolves this vulnerability by encrypting both authentication credentials and data packets over standard SSH.

In this guide, we explore how SFTP works, how to use it in your terminal, and how to connect using graphical tools like FileZilla or WinSCP with your RivinCloud VPS.

1. How SFTP Works vs Legacy FTP & FTPS

Feature	Legacy FTP	FTPS (FTP over SSL)	SFTP (SSH File Transfer)
Port	Port 21 (Plaintext)	Ports 21, 990 + Passive	Port 22 (SSH)
Encryption	None	SSL/TLS Layer	SSH Encrypted
Firewall Ease	Hard (dynamic ports)	Hard (passive port ranges)	Simple (single port 22)
Authentication	Plaintext Password	Password / Certificates	Password or SSH Keys

Because SFTP uses the existing SSH daemon (sshd), no additional software or port opening is needed on your RivinCloud VPS!

2. Interactive SFTP Command Line Usage

To start an SFTP connection from your terminal:

sftp username@your-server-ip

If using a custom SSH port:

sftp -P 2222 username@your-server-ip

Once connected, you enter the sftp> interactive shell.

Navigating Remote and Local Directories

pwd: Print remote directory path.
lpwd: Print local directory path (prefix l for local operations).
ls: List remote files.
lls: List local files.
cd /var/www: Change remote directory.
lcd /home/user/downloads: Change local directory.

Uploading and Downloading Files

Download a file (Remote -> Local):
```
sftp> get remote_file.zip
```
Upload a file (Local -> Remote):
```
sftp> put local_file.zip
```
Recursive Directory Download:
```
sftp> get -r /var/www/html/
```
Recursive Directory Upload:
```
sftp> put -r my-project-folder/
```
Exit session:
```
sftp> exit
```

3. Connecting via GUI Clients (FileZilla / WinSCP)

For users who prefer a drag-and-drop graphical interface:

Download and open FileZilla or WinSCP.
Set Protocol to SFTP - SSH File Transfer Protocol.
Host: Enter your RivinCloud server IP.
Port: 22 (or your custom SSH port).
Logon Type: Normal (for password) or Key File (browse for your .pem or .ppk private key).
Click Connect.

4. Restricting Users to SFTP Only (Chroot Jail)

If you have a developer or client who needs file upload access but should NOT have terminal SSH access:

Add group and user:

sudo groupadd sftpusers
sudo useradd -g sftpusers -d /upload -s /sbin/nologin clientuser
sudo passwd clientuser

Edit /etc/ssh/sshd_config:

Match Group sftpusers
    ChrootDirectory /var/sftp/%u
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTcpForwarding no

Restart SSH:
```
sudo systemctl restart sshd
```

Common Mistakes

Selecting FTP instead of SFTP in client software: Connecting on port 22 with the FTP protocol will timeout or fail immediately.
Strict chroot permissions: The ChrootDirectory must be owned by root:root and not writable by any other user or group, otherwise SSH will reject login for security reasons.

Troubleshooting

Permission Denied during upload: Verify that the remote directory is owned by the user account you are authenticating with (sudo chown -R ubuntu:ubuntu /target/directory).

Best Practices

Authenticate SFTP sessions using SSH public/private keypairs instead of passwords.
Change the default SSH port from 22 to reduce automated bot connection spam.

Frequently Asked Questions

Does SFTP require a separate FTP server like vsftpd or ProFTPD?

No. SFTP runs entirely through OpenSSH (sshd). Installing extra FTP daemons is unnecessary and introduces extra attack surface.

Conclusion

SFTP is the secure, reliable, and standard choice for transferring files to your Linux server. Use interactive CLI commands or your favorite GUI client to manage files safely on RivinCloud!