Tools: How To Use SFTP to Securely Transfer Files with a Remote Server

By Justin Ellingwood, Anish Singh Walia and Manikandan Kurup FTP, the File Transfer Protocol, was a popular, unencrypted method of transferring files between two remote systems. As of 2022, FTP is widely discouraged in modern environments due to its lack of security and is mainly used in legacy systems. SFTP, which stands for Secure File Transfer Protocol, is a separate protocol built into SSH that implements file transfer over a secure connection. Typically, it can act as a drop-in replacement in any context where an FTP server is still needed. In almost all cases, SFTP is preferable to FTP because of its underlying security features and ability to piggyback on an SSH connection. FTP is an insecure protocol that should only be used in limited cases or on networks you trust. Although SFTP is integrated into many graphical tools, this guide will demonstrate how to use it through its interactive command-line interface. By default, SFTP uses the SSH protocol to authenticate and establish a secure connection. Because of this, the same authentication methods are available that are present in SSH. Although you can authenticate with passwords by default, we recommend you create SSH keys and transfer your public key to any system that you need to access. This is much more secure and can save you time in the long run. Please see this guide to set up SSH keys in order to access your server if you have not done so already. If you can connect to the machine using SSH, then you have completed all of the necessary requirements to use SFTP to manage files. Test SSH access with the following command: If that works, exit back out by typing: Now we can establish an SFTP session by issuing the following command: You will connect to the remote system and your prompt will change to an SFTP prompt. If you are working on a custom SSH port (not the default port 22), then you can open an SFTP session as follows: This will connect you to the remote system by way of your specified port. The most useful command to learn first is the help command. This gives you access to a summary of the other SFTP commands. You can call it by typing either of these in the prompt: This will display a list of the available commands: We will explore some of the commands you see in the following sections. We can navigate through the remote system’s file hierarchy using a number of commands that function similarly to their shell counterparts. First, let’s orient ourselves by finding out which directory we are in currently on the remote system. Just like in a typical shell session, we can type the following to get the current directory: We can view the contents of the current directory of the remote system with another familiar command: Note that the commands available within the SFTP interface are not a 1:1 match for typical shell syntax and are not as feature-rich. However, they do implement some of the more important optional flags, such as adding -la to ls to view more file metadata and permissions: To get to another directory, we can issue this command: We can now traverse the remote file system, but what if we need to access our local file system? We can direct commands towards the local file system by preceding them with an l for local. All of the commands discussed so far have local equivalents. We can print the local working directory: We can list the contents of the current directory on the local machine: We can also change the directory we want to interact with on the local system: If we want to download files from our remote host, we can do so using the get command: As you can see, by default, the get command downloads a remote file to a file with the same name on the local file system. We can copy the remote file to a different name by specifying the name afterwards: The get command also accepts some option flags. For instance, we can copy a directory and all of its contents by specifying the recursive option: We can tell SFTP to maintain the appropriate permissions and access times by using the -P or -p flag: Transferring files to the remote system works the same way, but with a put command: The same flags that work with get apply to put. So to copy an entire local directory, you can run put -r: One familiar tool that is useful when downloading and uploading files is the df command, which works similarly to the command-line version. Using this, you can check that you have enough space to complete the transfers you are interested in: Please note that there is no local variation of this command, but we can get around that by issuing the ! command. The ! command drops us into a local shell, where we can run any command available on our local system. We can check disk usage by typing: Any other local command will work as expected. To return to your SFTP session, type: You should now see the SFTP prompt return. SFTP allows you to perform some kinds of filesystem housekeeping. For instance, you can change the owner of a file on the remote system with: Notice how, unlike the system chmod command, the SFTP command does not accept usernames, but instead uses UIDs. Unfortunately, there is no built-in way to know the appropriate UID from within the SFTP interface. As a workaround, you can read from the /etc/passwd file, which associates usernames with UIDs in most Linux environments: Note: If the remote user is restricted to a chroot environment, /etc/passwd may not be accessible or may contain limited information. Notice how instead of giving the ! command by itself, we’ve used it as a prefix for a local shell command. This works to run any command available on our local machine and could have been used with the local df command earlier. The UID will be in the third column of the file, as delineated by colon characters. Similarly, we can change the group owner of a file with: Again, there is no built-in way to get a listing of the remote system’s groups. We can work around it with the following command: The third column holds the ID of the group associated with name in the first column. This is what we are looking for. The chmod SFTP command works as normal on the remote filesystem. For example, to apply standard read and execute permissions: There is no equivalent command for manipulating local file permissions, but you can set the local umask, so that any files copied to the local system will have their corresponding permissions. That can be done with the lumask command: Now all regular files downloaded (as long as the -p flag is not used) will have 644 permissions. SFTP also allows you to create directories on both local and remote systems with lmkdir and mkdir respectively. The rest of the file commands target only the remote filesystem: These commands replicate the core behavior of their shell equivalents. If you need to perform these actions on the local file system, remember that you can drop into a shell by issuing this command: Or execute a single command on the local system by prefacing the command with ! like so: When you are finished with your SFTP session, use exit or bye to close the connection. SFTP can be used across various Linux distributions with some differences in setup procedures: Ensure that the SSH service is running on all distributions, as SFTP relies on it for secure file transfers. Integrating SFTP with CI/CD pipelines allows for secure deployment of files to remote servers. Use tools like Jenkins or GitLab CI/CD with plugins or scripts that support SFTP to automate file transfers. When integrating SFTP into CI/CD pipelines, use SSH key–based authentication and disable password login to avoid interactive prompts. When attempting to upload files via SFTP, you may encounter a “Permission Denied” error. This error occurs when the user does not have the necessary permissions to write to the target directory on the remote server. To resolve this issue, you need to adjust the file permissions and ownership of the target directory. A “Connection Refused” or “Timed Out” error can occur when attempting to connect to the SFTP server. This error is often indicative of a network connectivity issue or a problem with the SSH service on the server. A “Host Key Verification Failed” error occurs when the client’s known hosts file contains an outdated or incorrect host key for the SFTP server. A “Command Not Found” error can occur when the SFTP subsystem is not correctly configured on the server. SSH key authentication errors can occur when the public key is not correctly placed or has incorrect permissions on the server. SFTP, or Secure File Transfer Protocol, is a secure protocol used for transferring files over a network. It is built into SSH (Secure Shell) and provides a secure way to access, manage, and transfer files over a network. SFTP works by establishing a secure connection between a client and a server, allowing for the transfer of files between them. This connection is encrypted, ensuring that data is protected from unauthorized access. To connect to an SFTP server, you need to use an SFTP client. The command to connect to an SFTP server is similar to SSH: Replace user with your username and remote_server with the hostname or IP address of the server you want to connect to. You will be prompted to enter your password to authenticate. To upload files using SFTP, you can use the put command. The basic syntax is: Replace local_file with the path to the file you want to upload and remote_file with the path where you want to upload the file on the remote server. Yes, you can automate file transfers with SFTP using scripts or tools that support SFTP. For example, you can use a tool like lftp to automate file transfers. You can also use scripting languages like Python or Bash to automate SFTP transfers. SFTP is different from FTP (File Transfer Protocol) in that it provides a secure connection for transferring files, whereas FTP does not encrypt the data being transferred. SFTP is also different from SCP (Secure Copy) in that SCP is designed for copying files between hosts on a network, whereas SFTP provides a more comprehensive set of file management features, such as the ability to list directories, delete files, and create directories. SFTP uses port 22 by default, which is the same port used by SSH. To fix SFTP permission errors, you need to ensure that the user has the necessary permissions to read or write files on the remote server. This may involve changing the ownership or permissions of the files or directories in question. You can use the chown and chmod commands to change ownership and permissions, respectively. For example, run the following commands on the server shell (not inside the SFTP prompt): Replace user and group with the desired ownership and file with the path to the file you want to modify. Although SFTP syntax is much less comprehensive than modern shell tooling, it can be useful for providing compatibility with legacy FTP syntax or for carefully limiting the functionality available to remote users of some environments. For example, you can use SFTP to enable particular users to transfer files without SSH access. For more information on this process, check out our tutorial on How To Enable SFTP Without Shell Access. If you are used to using FTP or SCP to accomplish your transfers, SFTP is a good way to leverage the strengths of both. While it is not appropriate for every situation, it is a flexible tool to have in your repertoire. To further expand your knowledge on secure file transfers and remote access, consider following these additional tutorials: These tutorials will provide you with a comprehensive understanding of secure file transfer protocols and remote access methods, enabling you to manage your files and servers with confidence. Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases. Learn more about our products Former Senior Technical Writer at DigitalOcean, specializing in DevOps topics across multiple Linux distributions, including Ubuntu 18.04, 20.04, 22.04, as well as Debian 10 and 11. I help Businesses scale with AI x SEO x (authentic) Content that revives traffic and keeps leads flowing | 3,000,000+ Average monthly readers on Medium | Sr Technical Writer @ DigitalOcean | Ex-Cloud Consultant @ AMEX | Ex-Site Reliability Engineer(DevOps)@Nutanix With over 6 years of experience in tech publishing, Mani has edited and published more than 75 books covering a wide range of data science topics. Known for his strong attention to detail and technical knowledge, Mani specializes in creating clear, concise, and easy-to-understand content tailored for developers. This textbox defaults to using Markdown to format your answer. You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link! Awesome tuts. Thanks. Easier to use FilaZilla - hopefully my tutorial will be here soon. Sorry to steal your thunder: <a href=“https://www.digitalocean.com/community/articles/how-to-use-filezilla-to-transfer-and-manage-files-securely-on-your-vps”>How To Use Filezilla to Transfer and Manage Files Securely on your VPS</a>. -r works with put ??
i am trying , put -r localfile , and it is saying , invalid flag -r Please help. Using “put -r localDirectory” as a template (I want to upload all the files and folders from a folder on my local machine) I ran:
sftp> lpwd
Local working directory: /Users/Larry/Documents/Website
sftp> put -r . But the results had errors:
Uploading ./ to /var/www/html/.
remote open(“/var/www/html/.DS_Store”): Permission denied
Uploading of file ./.DS_Store to /var/www/html/.DS_Store failed!
remote open(“/var/www/html/.htaccess”): Permission denied
Uploading of file ./.htaccess to /var/www/html/.htaccess failed!
remote open(“/var/www/html/index.php”): Permission denied
Uploading of file ./index.php to /var/www/html/index.php failed! Not sure what is wrong, or how to fix it. Perhaps locally I have to be one directory above the desired folder to copy? sftp> lcd …
sftp> lpwd
Local working directory: /Users/Larry/Documents
sftp> put -r Website
Uploading Website/ to /var/www/html/Website
Couldn’t canonicalise: No such file or directory
Unable to canonicalise path “/var/www/html/Website”
sftp> Larry: It looks like you’re trying to upload files into a directory on the remote server that you do not have permission to write to. There are a few ways around this. You could upload them to a directory on the remote server that you do have access to, like your home directory, and then sign in through SSH and move the files over to the correct location (using sudo or by signing in with root). Another alternative is to log in as the root user when connecting through SFTP by giving a command like sftp root@your_server_ip. You would then have adequate permissions to transfer the files to the web root as you are attempting to do. Please write back if you have more questions. I had changed my ssh port when i configured my server so i use for example
ssh -p 4444 username@server_ip_addr but how can i do the same for sftp i tried
sftp -p 4444 username@server_ip_addr
but i did not work connection closing You need to give the argument -oPort sftp -oPort 4444 username@server_ip_addr Hey, I can ssh onto my droplet, but if I type “put”, it says “No command ‘put’ found”. It does the same for commands like “lpwd” and “lcd”. Any idea about what’s happening? You need to use the <code>sftp</code> command instead of <code>ssh</code> when you wish to use the SFTP functionality. This will take you into an SFTP session instead of a normal SSH session, and allow you to use the commands you mention and transfer files. Let me know if you have any additional questions. Please complete your information! Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation. Full documentation for every DigitalOcean product. The Wave has everything you need to know about building a business, from raising funding to marketing your product. Stay up to date by signing up for DigitalOcean’s Infrastructure as a Newsletter. New accounts only. By submitting your email you agree to our Privacy Policy Scale up as you grow — whether you're running one virtual machine or ten thousand. Sign up and get $200 in credit for your first 60 days with DigitalOcean.* *This promotional offer applies to new accounts only.