How To Enable Sftp On Linux – Secure SFTP Setup Commands

Securing file transfers on a Linux server starts with enabling the SFTP subsystem in your SSH configuration. If you are wondering how to enable sftp on linux, you are likely looking for a safe and reliable way to move files between machines without exposing your data to unnecessary risks. SFTP, which stands for SSH File Transfer Protocol, uses the same encryption as SSH, making it a far better choice than plain FTP.

This guide walks you through the entire process step by step. You will learn how to configure your SSH daemon, set up user accounts, and test your SFTP connection. By the end, you will have a fully functional SFTP server that keeps your files secure.

What Is SFTP And Why Use It?

SFTP is a network protocol that provides file access, transfer, and management over a reliable data stream. It runs over the SSH protocol, which means all data is encrypted during transit. This is a huge advantage over traditional FTP, which sends passwords and data in plain text.

Many administrators prefer SFTP because it does not require a separate daemon. It uses the same port (22) as SSH, simplifying firewall rules. You also get strong authentication options, including key-based login.

Key Benefits Of SFTP

• Encrypted data transfer
• Single port for both SSH and SFTP
• Supports public key authentication
• Works with existing SSH infrastructure
• No need for additional software installation

Prerequisites For Enabling SFTP On Linux

Before you start, make sure you have the following:

• A Linux server (Ubuntu, Debian, CentOS, or similar)
• Root or sudo access to the server
• SSH server installed (usually OpenSSH)
• Basic familiarity with the command line

Most Linux distributions come with OpenSSH pre-installed. If not, you can install it easily. For Ubuntu or Debian, run sudo apt update && sudo apt install openssh-server. For CentOS or RHEL, use sudo yum install openssh-server.

How To Enable Sftp On Linux

Now we get to the core of this article. The exact keyword How To Enable Sftp On Linux guides our steps here. The process involves editing the SSH configuration file and restarting the service.

Step 1: Locate The SSH Configuration File

The main configuration file for OpenSSH is /etc/ssh/sshd_config. Open it with a text editor like nano or vim. Use sudo to get the necessary permissions.

sudo nano /etc/ssh/sshd_config

Step 2: Check The SFTP Subsystem Line

Look for a line that starts with Subsystem sftp. It should look like this:

Subsystem sftp /usr/lib/openssh/sftp-server

If this line is commented out (starts with a #), remove the # to enable it. This line tells SSH to use the internal SFTP server.

Step 3: Configure SFTP Chroot Jail (Optional But Recommended)

A chroot jail restricts SFTP users to their home directories. This adds an extra layer of security. Add the following lines at the end of the configuration file:

Match group sftp
    ChrootDirectory %h
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTcpForwarding no

This configuration applies only to users in the sftp group. It forces them to use the internal SFTP subsystem and prevents shell access.

Step 4: Create An SFTP Group And User

Create a group called sftp:

sudo groupadd sftp

Now create a user and add them to the group:

sudo useradd -m -G sftp sftpuser
sudo passwd sftpuser

Set a strong password when prompted. If you want to use key-based authentication, copy the public key to the user’s authorized_keys file.

Step 5: Set Correct Permissions For Chroot Directory

The chroot directory must be owned by root. If you used the %h variable, the user’s home directory becomes the chroot. Change ownership:

sudo chown root:root /home/sftpuser

Then create a writable directory inside for file uploads:

sudo mkdir /home/sftpuser/upload
sudo chown sftpuser:sftpuser /home/sftpuser/upload

Step 6: Restart The SSH Service

Apply the changes by restarting SSH:

sudo systemctl restart sshd

Check the status to ensure it started without errors:

sudo systemctl status sshd

Testing Your SFTP Connection

You can test the connection from another machine using an SFTP client. On Linux, use the command line:

sftp sftpuser@your-server-ip

Enter the password when prompted. If everything is set up correctly, you will see an SFTP prompt. Try listing files or uploading a test file.

If you get a “connection refused” error, check that SSH is running and port 22 is open in your firewall. Also verify the configuration syntax:

sudo sshd -t

This command checks for syntax errors without restarting the service.

Advanced Configuration Options

Once basic SFTP is working, you can customize it further.

Limiting User Access To Specific Directories

You can change the ChrootDirectory to a custom path instead of the home directory. For example:

ChrootDirectory /sftp_data/%u

Then create the directory structure and set ownership correctly.

Disabling Password Authentication For SFTP Users

For better security, force key-based authentication. In the Match block, add:

PasswordAuthentication no

This means users in the sftp group can only connect with SSH keys.

Logging SFTP Activity

You can enable verbose logging by modifying the subsystem line:

Subsystem sftp /usr/lib/openssh/sftp-server -l INFO

Logs will appear in /var/log/auth.log or /var/log/secure depending on your distribution.

Common Issues And Fixes

Even with careful setup, you might run into problems. Here are some frequent issues and their solutions.

Permission Denied Errors

If you get “Permission denied” when trying to upload files, check the ownership of the chroot directory. Remember, the top-level directory must be owned by root. The writable subdirectory should be owned by the user.

SFTP Works But SSH Login Is Disabled

If you want to prevent SFTP users from getting a shell, the ForceCommand internal-sftp directive handles this. However, make sure the user’s shell is set to /usr/sbin/nologin or /bin/false for extra safety.

Connection Timed Out

This usually indicates a firewall issue. Check that port 22 is open. On Ubuntu, use sudo ufw allow 22. On CentOS, use sudo firewall-cmd --add-service=ssh --permanent and reload.

Security Best Practices For SFTP

Enabling SFTP is just the first step. Follow these practices to keep your server safe.

• Always use strong passwords or SSH keys
• Disable root login via SFTP
• Use a chroot jail to isolate users
• Regularly update OpenSSH to the latest version
• Monitor logs for suspicious activity
• Limit the number of concurrent connections

Disabling Root SFTP Access

In the SSH configuration, set PermitRootLogin no. This prevents root from logging in via SSH or SFTP. Use a regular user with sudo privileges instead.

Using SSH Keys Instead Of Passwords

Generate a key pair on your client machine:

ssh-keygen -t rsa -b 4096

Then copy the public key to the server:

ssh-copy-id sftpuser@your-server-ip

This method is more secure and convenient for automated transfers.

Automating SFTP Transfers With Scripts

You can use SFTP in scripts for automated backups or file synchronization. Create a batch file with SFTP commands:

#!/bin/bash
sftp sftpuser@server <

0 2 * * * /path/to/sftp-script.sh