SFTP-SERVER(8)

✨ SFTP-SERVER(8) ✨

okay bestie, gather round, because today we're talking about sftp-server — the OpenSSH SFTP server subsystem 💅 she's the whole entire server side of the SFTP protocol and she's serving, fr fr.

---

🎀 NAME 🎀

sftp-server — OpenSSH SFTP server subsystem

---

🌸 SYNOPSIS 🌸

sftp-server [-ehR] [-d start_directory] [-f log_facility] [-l log_level]
            [-P denied_requests] [-p allowed_requests] [-u umask]
            [-m force_file_perms]
sftp-server -Q protocol_feature

---

💖 DESCRIPTION 💖

so like. sftp-server is a program that speaks the server side of the SFTP protocol to stdout, and it's expecting client requests to come in from stdin. no cap. it is not meant to be called directly by you, bestie — no ma'am — it gets called from sshd(8) using the Subsystem option. iykyk.

any command-line flags you want to give sftp-server should be specified in the Subsystem declaration. go read sshd_config(5) for the deets. 📖

the valid options are... (drumroll please) 🥁

👑 OPTIONS 👑

• -d start_directory — sets an alternate starting directory for users. the pathname can contain these lil tokens that get expanded at runtime: %% becomes a literal %, %d becomes the home directory of the user being authenticated, and %u becomes the username of that user. default? just the user's home directory, obviously. this option is super useful when you're pairing it with the ChrootDirectory option from sshd_config(5). 🏠
• -e — makes sftp-server print its logging info to stderr instead of syslog, for debugging. it's giving "i need to see everything right now" energy. 🔍
• -f log_facility — picks the facility code used when logging messages from sftp-server. the possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. the default is AUTH. periodt. ✨
• -h — displays sftp-server usage information. the classic "help me help you" flag 🫶
• -l log_level — says which messages sftp-server will log. possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. INFO and VERBOSE log the transactions that sftp-server performs on behalf of the client. DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of debugging output. default is ERROR. 🗣️
• -P denied_requests — a comma-separated list of SFTP protocol requests that are banned by the server. sftp-server will reply to any denied request with a failure. you can use the -Q flag to figure out the supported request types. and heads up: if you specify both a denied and an allowed list, the denied list gets applied before the allowed list. 🚫
• -p allowed_requests — a comma-separated list of SFTP protocol requests that are permitted by the server. every request type that's not on the allowed list will be logged and replied to with a failure message.

⚠️ care must be taken when using this feature to ensure that requests made implicitly by SFTP clients are permitted. like, don't accidentally lock out the stuff your own client needs, bestie, that's a self-own 😭

• -Q protocol_feature — queries the protocol features supported by sftp-server. at present the only feature that may be queried is “requests”, which may be used to deny or allow specific requests (that's flags -P and -p respectively). 🔎
• -R — places this instance of sftp-server into read-only mode. attempts to open files for writing, plus other operations that change the state of the filesystem, will be denied. no touchy. 🙅♀️
• -u umask — sets an explicit umask(2) to be applied to newly-created files and directories, instead of the user's default mask. 🌱
• -m force_file_perms — sets explicit file permissions applied to newly-created files, instead of the default or client-requested mode. numeric values include: 777, 755, 750, 666, 644, 640, etc. and listen — using both -m and -u switches makes the umask (-u) effective only for newly created directories, and the explicit mode (-m) for newly created files. slay, but keep that straight. 💅

---

on some systems, sftp-server must be able to access /dev/log for logging to work, and use of sftp-server in a chroot configuration therefore requires that syslogd(8) establish a logging socket inside the chroot directory. lowkey important, don't skip this one 🧚

---

🌈 SEE ALSO 🌈

• sftp(1)
• ssh(1)
• sshd_config(5)
• sshd(8)
• T. Ylonen and S. Lehtinen, SSH File Transfer Protocol, draft-ietf-secsh-filexfer-02.txt, October 2001, work in progress material. 📄

---

🦋 HISTORY 🦋

sftp-server first appeared in OpenBSD 2.8. an icon, an OG, a legend. 👑

---

💜 AUTHORS 💜

Markus Friedl <markus@openbsd.org> — thank you for your service, king 🫡

---

and that's the whole vibe check, bestie 💖 this page came from the Debian crew, dated July 27, 2021, and it lives in the SFTP-SERVER(8) section of the manual — go forth and sftp responsibly, mwah 🎀✨🌸