# sftp-server

## NAME



           **sftp-server** — OpenSSH SFTP server subsystem
    


## SYNOPSIS



           **sftp-server**[**-ehR**] [**-d** _start_directory_] [**-f** _log_facility_]
           [**-l** _log_level_] [**-P** _denied_requests_] [**-p** _allowed_requests_]
           [**-u** _umask_] **sftp-server -Q** _protocol_feature_
    


## DESCRIPTION



           **sftp-server** is a program that speaks the server side of SFTP
           protocol to stdout and expects client requests from stdin.
           **sftp-server** is not intended to be called directly, but from
           _sshd_(8) using the **Subsystem** option.
    
           Command-line flags to **sftp-server** should be specified in the
           **Subsystem** declaration.  See _sshd_config_(5) for more information.
    
           Valid options are:
    
           **-d** _start_directory_
                   Specifies an alternate starting directory for users.  The
                   pathname may contain the following tokens that are
                   expanded at runtime: %% is replaced by a literal '%', %d
                   is replaced by the home directory of the user being
                   authenticated, and %u is replaced by the username of that
                   user.  The default is to use the user's home directory.
                   This option is useful in conjunction with the
                   _sshd_config_(5) **ChrootDirectory** option.
    
           **-e** Causes **sftp-server** to print logging information to stderr
                   instead of syslog for debugging.
    
           **-f** _log_facility_
                   Specifies the facility code that is used when logging
                   messages from **sftp-server**.  The possible values are:
                   DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, LOCAL3,
                   LOCAL4, LOCAL5, LOCAL6, LOCAL7.  The default is AUTH.
    
           **-h** Displays **sftp-server** usage information.
    
           **-l** _log_level_
                   Specifies which messages will be logged by **sftp-server**.
                   The possible values are: QUIET, FATAL, ERROR, INFO,
                   VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3.  INFO and
                   VERBOSE log transactions that **sftp-server** performs on
                   behalf of the client.  DEBUG and DEBUG1 are equivalent.
                   DEBUG2 and DEBUG3 each specify higher levels of debugging
                   output.  The default is ERROR.
    
           **-P** _denied_requests_
                   Specifies a comma-separated list of SFTP protocol requests
                   that are banned by the server.  **sftp-server** will reply to
                   any denied request with a failure.  The **-Q** flag can be
                   used to determine the supported request types.  If both
                   denied and allowed lists are specified, then the denied
                   list is applied before the allowed list.
    
           **-p** _allowed_requests_
                   Specifies a comma-separated list of SFTP protocol requests
                   that are permitted by the server.  All request types that
                   are not on the allowed list will be logged and replied to
                   with a failure message.
    
                   Care must be taken when using this feature to ensure that
                   requests made implicitly by SFTP clients are permitted.
    
           **-Q** _protocol_feature_
                   Queries protocol features supported by **sftp-server**.  At
                   present the only feature that may be queried is
                   “requests”, which may be used to deny or allow specific
                   requests (flags **-P** and **-p** respectively).
    
           **-R** Places this instance of **sftp-server** into a read-only mode.
                   Attempts to open files for writing, as well as other
                   operations that change the state of the filesystem, will
                   be denied.
    
           **-u** _umask_
                   Sets an explicit _umask_(2) to be applied to newly-created
                   files and directories, instead of the user's default mask.
    
           On some systems, **sftp-server** must be able to access _/dev/log_ for
           logging to work, and use of **sftp-server** in a chroot configuration
           therefore requires that _syslogd_(8) establish a logging socket
           inside the chroot directory.
    


* * *