SFTP and SCP: Secure File Transfer

Despite its name, SFTP (SSH File Transfer Protocol) has nothing to do with FTP. It is a binary protocol designed to run as an SSH-2 subsystem, meaning it operates over an existing authenticated and encrypted SSH connection. The SSH client invokes the SFTP subsystem on the server with the command ssh user@host -s sftp. All SFTP operations inherit the security guarantees of the underlying SSH transport.

SFTP provides a rich set of file operations over the encrypted channel: listing directory contents, uploading files, downloading files, deleting and renaming files, creating and removing directories, reading and setting file permissions and timestamps, and resuming interrupted transfers. These capabilities make SFTP a complete remote file system interface, not merely a file transfer tool.

SCP (Secure Copy Protocol) is an older, simpler protocol for transferring files over SSH. The command scp file.txt user@host:/path copies a file securely. SCP is simpler to use than SFTP for one-off transfers but supports only a subset of operations: copy from local to remote, remote to local, or remote to remote. It has no interactive mode and limited support for resuming interrupted transfers.

The original SCP protocol had a significant vulnerability: a malicious server could send arbitrary files to the client regardless of what the client requested. An attacker controlling the server could overwrite files outside the intended destination directory. OpenSSH deprecated the legacy SCP protocol in favour of SFTP-based scp in OpenSSH 9.0 (2022). Modern scp commands use SFTP underneath, eliminating this attack class while preserving the familiar command syntax.

Three secure file transfer options are commonly confused. FTP (port 21) is unencrypted and should not be used. FTPS (FTP over SSL) adds TLS to FTP on port 990 (implicit) or port 21 (explicit with AUTH TLS), requiring the FTP infrastructure plus certificate management. SFTP is an entirely separate protocol over SSH (port 22), reusing existing SSH authentication and key management. SFTP is generally simpler to configure and maintain than FTPS.

rsync is a file synchronisation tool that transfers only the changed parts of files, making it far more efficient than SCP for incremental backups. Running rsync with -e ssh flag routes all data through an SSH tunnel. The command rsync -avz -e ssh user@host:/remote/ /local/ synchronises a remote directory to local, transferring only deltas. rsync over SSH is the standard approach for server backups and deployment workflows.

SFTP supports resumable transfers: if a connection drops during a large upload, the transfer can be resumed from the last acknowledged byte rather than restarted from zero. OpenSSH's sftp client supports the reput command for resuming uploads and reget for resuming downloads. For very large transfers (multi-gigabyte files), tools like lftp provide more robust transfer management with automatic retry and bandwidth throttling.

The OpenSSH server can restrict SFTP users to a specific directory tree using a chroot jail. Adding the Match User directive with ChrootDirectory and ForceCommand internal-sftp to the SSH configuration creates an isolated SFTP environment. The user can upload and download files within their designated directory but cannot access the rest of the filesystem or execute shell commands. This is widely used for web hosting file management and client upload portals.

Enabling SFTP on an OpenSSH server requires adding Subsystem sftp /usr/lib/openssh/sftp-server to sshd_config. The sftp-server binary handles all SFTP protocol operations. For chroot configurations, the ChrootDirectory must be owned by root and not writable by any other user, a common source of configuration errors. Testing the configuration with sshd -t checks syntax before reloading the service.

SFTP integrates well with automated backup pipelines. A backup server uses public key authentication to connect without passwords, enabling cron-scheduled transfers without human intervention. The backup user is restricted by chroot to the upload directory, limiting the damage if the backup server is ever compromised. Log monitoring for SFTP connection failures and transfer errors provides early warning of backup problems before they affect recovery capability.

Beyond the command-line sftp client, graphical tools like FileZilla, Cyberduck, and WinSCP support SFTP with drag-and-drop interfaces, bookmark management, and side-by-side directory views. These tools are popular for developers and administrators who prefer GUI workflows. All use the same underlying SFTP protocol and SSH authentication, including support for SSH key files and the system SSH agent.

What was the main security vulnerability in the legacy SCP protocol that led OpenSSH to replace it with an SFTP-based implementation?

SFTP is an SSH subsystem, not related to FTP. It provides full remote file system operations over encrypted SSH. SCP is simpler but the legacy protocol had a server-side path traversal vulnerability fixed in OpenSSH 9.0 by switching to SFTP underneath. FTPS adds TLS to FTP while SFTP is entirely SSH-based. rsync over SSH provides efficient incremental synchronisation. Chroot jails restrict SFTP users to designated directories.