A step-by-step guide to set up an SFTP file transfer server in Linux
Tags: linux, ubuntu, sftp
Published: 2021-02-24 19:05:51

In this tutorial, we are going to learn how to set up a remote server for secure file transfer between the user's local machine and remote server over SFTP. SFTP is known as Secure File Transfer Protocol or SSH File Transfer Protocol. 

Before we start, please ensure the following:

1. You have access to a Linux remote machine (this tutorial used Ubuntu server distro 20.xx)
2. You have login access to a remote machine through SSH
3. The User access you have is listed under sudo group
4. The local machine can be of any OS - Mac, Linux, Windows, etc. - on which you can have access to a remote machine through SSH.

Let's first set up a user account typing the following commands in a terminal of the remote machine.

#### 1. Create a user group

```
sudo groupadd sftpgroup
```

#### 2. Create user

```
sudo useradd -m vyndour 
```

#### 3. Assign a password to the user
```
sudo passwd vyndour
```
#### 4. Add user to our _sftpgroup_

```
sudo usermod -a -G sftpgroup vyndour
```
#### 6. Make user the owner of it's own directory

```
sudo chown vyndour /home/vyndour
```
####   5. Give read(r),write(w) and execute(x) access of user's directory to only user

```
sudo chmod 700 /home/vyndour
```

> In case we need to add more users, we can repeat steps 2-6.

Now, let's install the openssh server and set up SFTP settings.

#### 7. First, let's update the existing packages
```
sudo apt update
sudo apt upgrade
```
#### 8. Install openssh-sever
```
sudo apt install openssh-server
```
#### 9. Open SSHD_config file
```
sudo nano /etc/ssh/sshd_config
```

#### 10. Copy the following lines at the end of the _sshd\_config_file

```
# FOR SSH key authentication
	
PubkeyAuthentication yes
AuthorizedKeysFile    .ssh/authorized_keys
	
# FOR password authentication
	
PasswordAuthentication yes
	
#  SFTP configuration
	
Match group sftpgroup
ChrootDirectory /home
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
```
##### ctrl+s : save the _sshd\_config_ file and ctr+x: exit from _sshd\_config_ file

> If we want SSH key authentication for SFTP file transfer, we need to set  `PubkeyAuthentication yes` and also we need to specify the file name holding SSH public key `AuthorizedKeysFile .ssh/authorized_keys`. We will create SSH key in step - 12 below.
> 
> Similarly, if we want password authentication for SFTP file transfer, we need to set `PasswordAuthentication yes`. The password is the user's password that we have set earlier in step-3. 

#### 11. For SSH public key authetication , follow the following steps to create and install SSH keys

Open a terminal in our local machine, and create a pair of SSH private and public keys by running the following command.
```
ssh-keygen -f sftp_rsa -t rsa
```
Once we run the above command, two files will be generated - one private key `sftp_rsa` and the public key `sftp_rsa.pub`. Let's Keep the private key securely with read(r) access to only the user in the user's local system. 

> We can always change the type of key. Let's stick to the default RSA type key in this tutorial.

```	
# On  user's local machine
sudo chmod 400 <path to the private key in user's local machine>
```
Then, in our remote PC create a file in `/home/vyndour/.ssh` and name it as `authorized_keys`. Copy the content of public key `sftp_rsa.pub` from local machine to `authorized_keys` file in a remote machine.

create a .ssh directory in the user's directory in the remote machine.
```	
sudo mkdir /home/vyndour/.ssh
```
Open  a new file with the name `authorized_keys` in the remote machine
```
	sudo nano /home/vyndour/.ssh/authorized_keys
```
Manual task: copy and paste the content manually from `sftp_rsa.pub` (local machine) key to the `authorized_keys` (remote machine)
	
Deny write(w) and execute(x) of `authorized_keys` by the user with the following command in the remote machine.
```
sudo chmod 644 /home/vyndour/.ssh/authorized_keys
```

As an alternative to the above method, you can transfer the public-key file `sftp_rsa` to the remote server using SCP. In our local machine, use SCP to transfer `sftp_rsa.pub` file to root directory of remote machine with the following command.
```
sudo scp -i <ssh key that gives access to remote machine> <path to public key in user's local machine> <sudo user>@<ip address of remote machine>:/
```
create a .ssh directory in the user's directory in the remote machine.

```
sudo mkdir /home/vyndour/.ssh
```
In the remote machine, create a file in `/home/vyndour/.ssh`  and name it as `authorized_keys`, and append the key from `sftp_rsa.pub` file located in root directory`/`.

```
sudo touch /home/vyndour/authorized_keys
sudo cat /sftp_rsa.pub >> /home/vyndour/.ssh/authorized_keys
```
Deny delete of authorized_keys by the user with the following command in the remote machine.

```
sudo chmod 644 /home/vyndour/.ssh/authorized_keys
```

Don't forget to remove the public key from the root directory.

```
sudo rm /sftp_rsa.pub
```

#### 12. Restart SSH

Let's now restart the ssh server with the following command:

```
sudo systemctl restart sshd
```
#### 13. Monitor the logs (Optional for debugging)

In case we need to debug the login through SSH, we can open the `/var/log/auth.log` file to live monitor the logs.

```
sudo tail -f /var/log/auth.log
```
#### 14. Browse User's directory from the local machine

We can now use software like FileZilla, Cyberduck, or similar to browse the user directory in the remote machine over SFTP with the following typical entries in our local machine:

* Host: sftp://vyndour@\<remote machine IP adddress>

* Port : 22  # Default SSH port

* Password: User's password  # if `PasswordAuthentication yes` in sshd_config file

* Private key path: <path to private key `sftp_rsa` in local machine>  # if `PubkeyAuthentication yes` in `sshd_config` file

We are done! :)
I hope you enjoyed this post. I would appreciate your feedback/suggestions/comments in the comment section below.

Thanks.

### Follow Me :
[YouTube CodeFuture](https://www.youtube.com/channel/UCMat0Hlx67xwLrhIKRWMjEw) , [Twitter](https://twitter.com/Code9Rrr)

`#SFTP`  ` #Linux`  `#Ubuntu`  `#SSH `  `#File Transfer `