SFTP

Problem

You need to transfer files between machines across an untrusted network. Plain FTP can expose credentials and data.

Solution — SFTP

SFTP performs file operations over SSH's secure channel. The client connects over TCP, usually on port 22, verifies the server's SSH host key against a trusted key or certificate, and establishes encryption keys through a key exchange. The server then authenticates the user, for example with a password or public key. For an upload, SFTP sends requests to open a file, write chunks at specified positions, and close it. SSH encrypts these requests and file data and checks for tampering; the server decrypts them and writes the file according to the user's permissions.

Client
   ║ encrypted
Internet
   ║
Server

Core idea: SFTP provides secure remote file transfer over SSH.