sftpInteractive and scripted file transfer over SSH
sftp opens an interactive file-transfer session over SSH: browse remote directories, get and put files, resume transfers. It's also what partners and vendors use to drop files on your servers, through SFTP-only accounts locked into a chroot.
sftp [-P PORT] [-i KEY] [-J JUMP] [-b BATCHFILE] [USER@]HOST[:PATH]You need to look around a server's directories and fetch a couple of files without knowing exact paths.
sftpSSH File Transfer Protocol client. Same keys, host checks and ~/.ssh/config as ssh.
sftp starts ssh and asks the server for the 'sftp' subsystem; sshd runs its SFTP server (sftp-server, or the built-in internal-sftp). From then on the client sends binary requests over the encrypted channel: OPEN, READ and WRITE file handles at offsets, STAT, READDIR, MKDIR, RENAME, REMOVE. It is a file-access protocol, not a shell: there is no command execution and no glob expansion by a remote shell, which is why sshd can safely offer SFTP-only accounts with ForceCommand internal-sftp and a ChrootDirectory, so a partner sees only their own directory as /. Because reads and writes carry offsets, reget and reput can resume partial transfers. Commands that start with l (lcd, lls, lpwd) act on the local side. In batch mode (-b) any failing command aborts the session with a non-zero exit code unless the command is prefixed with '-'.
-b FILEBatch mode: run commands from FILE ('-' = stdin), abort on error-P PORTRemote SSH port-i KEYPrivate key file-J user@bastionJump host-rRecursive get/put for directories (also: get -r, put -r)-l KBITBandwidth limitget / putDownload / upload a file (-r for directories)reget / reputResume a partial download / uploadls, cd, pwd, mkdir, rm, renameRemote file operationslls, lcd, lpwdThe same on the local side-prefixIn batch files, ignore errors from that commandScripting sftp with a here-document and no -bWithout batch mode sftp continues after errors and exits 0, so failed uploads go unnoticed.
sftp -b commands.txt host # exits non-zero on the first errorExpecting to run commands like sudo or chmod -R in sftpSFTP is a file protocol, not a shell: only its own commands exist and they run as the logged-in user.
Use ssh for commands; sftp only for transfers.Giving partners a normal shell account for file dropsThey can run commands and explore the whole server.
Match Group sftponly / ForceCommand internal-sftp / ChrootDirectory /srv/sftp/%u in sshd_configTry these on a Linux machine of your own. Each task has a hint and a solution.
Write a batch file that changes to /tmp on the server, uploads report.csv, and lists the directory. Then write the sftp command to run it against [email protected].
Inside an sftp session, how do you list your LOCAL directory and change the local directory to ~/downloads?
Write the sshd_config block that makes members of the group sftponly SFTP-only and chrooted to /srv/sftp/<username>.
sftpInteractive and scripted file transfer over SSH
sftp opens an interactive file-transfer session over SSH: browse remote directories, get and put files, resume transfers. It's also what partners and vendors use to drop files on your servers, through SFTP-only accounts locked into a chroot.
sftp [-P PORT] [-i KEY] [-J JUMP] [-b BATCHFILE] [USER@]HOST[:PATH]You need to look around a server's directories and fetch a couple of files without knowing exact paths.
sftpSSH File Transfer Protocol client. Same keys, host checks and ~/.ssh/config as ssh.
sftp starts ssh and asks the server for the 'sftp' subsystem; sshd runs its SFTP server (sftp-server, or the built-in internal-sftp). From then on the client sends binary requests over the encrypted channel: OPEN, READ and WRITE file handles at offsets, STAT, READDIR, MKDIR, RENAME, REMOVE. It is a file-access protocol, not a shell: there is no command execution and no glob expansion by a remote shell, which is why sshd can safely offer SFTP-only accounts with ForceCommand internal-sftp and a ChrootDirectory, so a partner sees only their own directory as /. Because reads and writes carry offsets, reget and reput can resume partial transfers. Commands that start with l (lcd, lls, lpwd) act on the local side. In batch mode (-b) any failing command aborts the session with a non-zero exit code unless the command is prefixed with '-'.
-b FILEBatch mode: run commands from FILE ('-' = stdin), abort on error-P PORTRemote SSH port-i KEYPrivate key file-J user@bastionJump host-rRecursive get/put for directories (also: get -r, put -r)-l KBITBandwidth limitget / putDownload / upload a file (-r for directories)reget / reputResume a partial download / uploadls, cd, pwd, mkdir, rm, renameRemote file operationslls, lcd, lpwdThe same on the local side-prefixIn batch files, ignore errors from that commandScripting sftp with a here-document and no -bWithout batch mode sftp continues after errors and exits 0, so failed uploads go unnoticed.
sftp -b commands.txt host # exits non-zero on the first errorExpecting to run commands like sudo or chmod -R in sftpSFTP is a file protocol, not a shell: only its own commands exist and they run as the logged-in user.
Use ssh for commands; sftp only for transfers.Giving partners a normal shell account for file dropsThey can run commands and explore the whole server.
Match Group sftponly / ForceCommand internal-sftp / ChrootDirectory /srv/sftp/%u in sshd_configTry these on a Linux machine of your own. Each task has a hint and a solution.
Write a batch file that changes to /tmp on the server, uploads report.csv, and lists the directory. Then write the sftp command to run it against [email protected].
Inside an sftp session, how do you list your LOCAL directory and change the local directory to ~/downloads?
Write the sshd_config block that makes members of the group sftponly SFTP-only and chrooted to /srv/sftp/<username>.