SFTP for sites

Each site can have its own SFTP access, to upload and manage its files with an app such as FileZilla.

What a site's SFTP user can do

• Log in with an SSH key only. There are no SFTP passwords.
• See only that site's folders: public (the website), private, logs and tmp. Nothing else on the server.
• Upload, download, rename and delete files there. No shell, no commands, no tunnels.

Turn it on

On the site's page, under SFTP: select Turn on SFTP, then Add key and paste the public key of each computer that should log in. The card shows the host, port and user to use.

Making a key, if you don't have one:

ssh-keygen -t ed25519 -C "laptop"
cat ~/.ssh/id_ed25519.pub

Paste the line cat prints (it starts with ssh-ed25519). The file without .pub is your private key: it stays on your computer, and you never paste it anywhere. The panel refuses a private key if you paste one by mistake.

Good to know

• Removing a key or turning SFTP off ends that site's open SFTP sessions at once. Turning SFTP off also deletes its keys; add them again to use it later.
• Uploaded files keep who may read them. A file only you can read on your computer (mode 600) stays private, and the website can't show it. Make it readable (mode 644) before uploading, or change it in your SFTP app.
• On the first connection, your SFTP app shows the server's key. Check it against the one on the site's SFTP card before you accept it.
• SFTP needs the SSH rule in Security notes.