In computing, the SSH File Transfer Protocol is a network protocol that provides file access,
file transfer, and file management functionalities over any reliable data stream.
It was designed by the Internet Engineering Task Force as an extension of the Secure Shell
protocol version 2.0 to provide secure file transfer capability, but is also intended
to be usable with other protocols.
The IETF Internet Draft states that even though this protocol is described in the context
of the SSH-2 protocol, it could be used in a number of different applications, such as
secure file transfer over Transport Layer Security and transfer of management information
in VPN applications.
This protocol assumes that it is run over a secure channel, such as SSH, that the server
has already authenticated the client, and that the identity of the client user is available
to the protocol.
Capabilities Compared to the SCP protocol, which only allows
file transfers, the SFTP protocol allows for a range of operations on remote files – it
is more like a remote file system protocol.
An SFTP client's extra capabilities compared to an SCP client include resuming interrupted
transfers, directory listings, and remote file removal.
SFTP attempts to be more platform-independent than SCP; for instance, with SCP, the expansion
of wildcards specified by the client is up to the server, whereas SFTP's design avoids
this problem.
While SCP is most frequently implemented on Unix platforms, SFTP servers are commonly
available on most platforms.
SFTP is not FTP run over SSH, but rather a new protocol designed from the ground up by
the IETF SECSH working group.
It is sometimes confused with Simple File Transfer Protocol.
The protocol itself does not provide authentication and security; it expects the underlying protocol
to secure this.
SFTP is most often used as subsystem of SSH protocol version 2 implementations, having
been designed by the same working group.
However, it is possible to run it over SSH-1 or other data streams.
Running an SFTP server over SSH-1 is not platform independent as SSH-1 does not support the
concept of subsystems.
An SFTP client willing to connect to an SSH-1 server needs to know the path to the SFTP
server binary on the server side.
For uploads, the transferred files may be associated with their basic attributes, such
as timestamps.
This is an advantage over the common FTP protocol, which does not have provision for uploads
to include the original date/timestamp attribute without help.
History and development The Internet Engineering Task Force working
group "Secsh" that was responsible for the development of the Secure Shell version 2
protocol also attempted to draft an extension of that standard for secure file transfer
functionality.
Internet Drafts were created that successively revised the protocol into new versions.
The software industry began to implement various versions of the protocol before the drafts
were standardized.
As development work progressed, the scope of the Secsh File Transfer project expanded
to include file access and file management.
Eventually, development stalled as some committee members began to view SFTP as a file system
protocol, not just a file access or file transfer protocol, which places it beyond the purview
of the working group.
After a seven-year hiatus, in 2013 an attempt was made to restart work on SFTP using the
version 3 draft as the baseline.
Versions 0 - 2 Prior to the IETF's involvement, SFTP was
a proprietary protocol of SSH Communications Security, designed by Tatu Ylönen with assistance
from Sami Lehtinen in 1997.
Differences between versions 0 - 2 and version 3 are enumerated upon in section 10 of draft-ietf-secsh-filexfer-02.
Version 3 At the outset of the IETF Secure Shell File
Transfer project, the Secsh group stated that its objective of SSH File Transfer Protocol
was to provide a secure file transfer functionality over any reliable data stream, and to be the
standard file transfer protocol for use with the SSH-2 protocol.
Drafts 00 - 02 of the IETF Internet Draft define successive revisions of version 3 of
the SFTP protocol.
SSH File Transfer Protocol, Draft 00, January 2001
SSH File Transfer Protocol, Draft 01, March 2001
SSH File Transfer Protocol, Draft 02, October 2001
Version 4 Drafts 03 - 04 of the IETF Internet Draft
define version 4 of the protocol.
SSH File Transfer Protocol, Draft 03, October 2002
SSH File Transfer Protocol, Draft 04, December 2002
Version 5 Draft 05 of the IETF Internet Draft defines
version 5 of the protocol.
SSH File Transfer Protocol, Draft 05, January 2004
Version 6 Drafts 06 - 13 of the IETF Internet Draft
define successive revisions of version 6 of the protocol.
SSH File Transfer Protocol, Draft 06, October 2004
SSH File Transfer Protocol, Draft 07, March 2005
SSH File Transfer Protocol, Draft 08, April 2005
SSH File Transfer Protocol, Draft 09, June 2005
SSH File Transfer Protocol, Draft 10, June 2005
SSH File Transfer Protocol, Draft 11, January 2006
SSH File Transfer Protocol, Draft 12, January 2006
SSH File Transfer Protocol, Draft 13, July 2006
Software SFTP client
The term SFTP can also refer to Secure file transfer program, a command-line program that
implements the client part of this protocol.
As an example, the sftp program supplied with OpenSSH implements this.
Some implementations of the scp program support both the SFTP and SCP protocols to perform
file transfers, depending on what the server supports.
SFTP server There are numerous SFTP server implementations
both for UNIX, Windows and z/OS.
The most widely known is perhaps OpenSSH, but there are also proprietary implementations.
Typically the port used is 22.
SFTP file transfer protocol is part of SSH protocol suite.
SFTP proxy It is difficult to control SFTP transfers
on security devices at the network perimeter.
There are standard tools for logging FTP transactions, like TIS fwtk or SUSE FTP proxy, but SFTP
is encrypted, rendering traditional proxies ineffective for controlling SFTP traffic.
There are some tools that implement man-in-the-middle for SSH which also feature SFTP control.
Examples of these tools include Shell Control Box from Balabit and FileGate SFP from Presaris.
These provide functions such as SFTP transaction logging and logging of the actual data transmitted
on the wire.
See also
SSH Communications Security Comparison of SSH servers
Comparison of SSH clients FISH
AbsoluteTelnet - SSH client that includes a GUI SFTP client for file transfer.
SSHFS - Mounting remote filesystem using SFTP and SSH
Lsh - A GNU SSH-2 and SFTP server for Unix-like OSes
List of file transfer protocols FTPS
Category:FTP clients Category:SFTP clients
References
External links Chrooted SFTP with Public Key Authentication
– Integrating SFTP into FreeBSD production servers using the public key cryptography
approach