What Is SFTP? A Guide to the SFTP Protocol

SFTP is a way to transfer files or other data between computers that need stronger security than the FTP protocol offers, especially for people using Hosting. So What is SFTP? What are the pros and cons of SFTP? How do you secure it and log in to SFTP? Let's find out with MONA Media find out in the article below.

What is SFTP?

SFTP stands for Secure File Transfer Protocol, or SSH File Transfer Protocol. It is a network protocol that lets you upload or download data on a server. You can also use it to edit, create or delete files and folders on a Linux server.

Although you can authenticate with a username and password, SSH can authenticate with a key pair for security, because a computer-generated key can replace the user's password. Computer-generated keys are also much longer than ordinary passwords, which makes it practically impossible for hackers to copy them in brute-force attacks.

In most cases developers prefer SFTP to FTP. SFTP connects over the SSH protocol, so the data you move through it is encrypted and better protected. Besides stronger security, SFTP also beats FTP in being able to connect with SSH. FTP is still used in places with strong network security or in a few other restricted cases.

What is SFTP used for?

SFTP is used in many situations, especially when file security is the priority. One of the most important is compliance with standards such as the US Health Insurance Portability and Accountability Act (HIPAA).

Any business has to keep PHI confidential, including while it moves across networks as digital packets. That is why SFTP is useful for protecting this kind of data.

SFTP is one option for protecting that data in transit, so hackers cannot get it and the company does not violate HIPAA where the law applies.

SFTP can also meet other data protection standards. For example, the General Data Protection Regulation (GDPR), which governs the data of European users, may require this kind of security.

SFTP is also useful when sensitive data needs protecting. For example, trade secrets may not be covered by any specific data security rule, but it can be very dangerous if they fall into the wrong hands. Businesses can use SFTP to transfer files containing trade secrets or similar information.

Individual users may also want to encrypt their communications.

Pros and cons of SFTP

To understand why SFTP is so popular, you need to know its pros and cons:

Advantages of SFTP

SFTP has attracted many users thanks to these advantages:

• SFTP's biggest advantage is its security, which is also what users value most when they look into what an SFTP server is.
• Login information is encrypted and protected from hackers when sent over SFTP.
• You can raise security further by combining key pair authentication with a username and password.
• Also, an SFTP server uses only one server connection to transfer data, and no other server port needs to be open for it to work. This adds to its security and makes it firewall-friendly.

Disadvantages of SFTP

SFTP looks pretty perfect, but in practice the protocol still has some limitations:

• Managing SSH keys is not easy.
• When you transfer files, the private key must be protected against theft and loss.
• Enabling SSH keys takes training because the setup is fairly complicated.
• But if you can work around these drawbacks, SFTP may be the best protocol for you.

How to secure SFTP

An SFTP connection can be authenticated in two ways:

• Basic authentication requires a user ID and password from the SFTP client to connect to the SFTP server.
• SSH authentication uses SSH keys to authenticate SFTP connections, or combines them with a user ID and password. In this case you need an SSH public key and a private key pair, set up with these steps:

Step 1: Generate a key pair on your computer (the SFTP client) and copy the public key to the SFTP server.

Step 2: When the server authenticates the connection with you, PuTTY creates a signature with your private key.

Step 3: Once the server has the matching public key, it can verify the signature and authenticate your connection.

Even if the SFTP server is attacked or spoofed, the attacker only gets a signature, not your private key or password. Because a signature cannot be reused, they gain nothing.

How to log in to SFTP

To log in to SFTP you can use a command or supporting software. I recommend software because it is easier to use, and most FTP software also supports SFTP.

SFTP login details

You can use your SSH login details to log in to SFTP. That also means using port 22 on the server, or the port you changed it to if you moved it from 22.

Logging in to SFTP on Windows

On Windows you can use WinSCP to log in to a Linux server over SFTP.

Logging in to SFTP on Linux

If you use Linux on your machine, such as Ubuntu, Linux Mint or CentOS, you can use FileZilla to log in to a Linux server over SFTP.

You can also use the SFTP command in Terminal if you prefer not to use outside software.

Logging in to SFTP on macOS

On macOS you can also use FileZilla, but Cyberduck is the better pick because its interface is friendlier. If you want better paid SFTP/FTP software, you can use Transmit.

As on Linux, you can also use the sftp command in Terminal to log in to a remote Linux server.

Now you know what SFTP is and its pros and cons. Look into them carefully and choose the protocol that suits you best.