{"id":921,"date":"2024-10-25T02:28:39","date_gmt":"2024-10-24T21:28:39","guid":{"rendered":"https:\/\/blake.azuela.info\/?p=921"},"modified":"2024-10-28T21:46:33","modified_gmt":"2024-10-28T16:46:33","slug":"setting-up-sftp-on-almalinux-centos-or-debian-ubuntu","status":"publish","type":"post","link":"https:\/\/blake.azuela.info\/index.php\/2024\/10\/25\/setting-up-sftp-on-almalinux-centos-or-debian-ubuntu\/","title":{"rendered":"Setting Up SFTP on AlmaLinux\/CentOS or Debian\/Ubuntu"},"content":{"rendered":"\n


Setting up an SFTP server should be smooth and efficient, and with this guide, you’ll have it done in no time! Whether you’re using AlmaLinux\/CentOS<\/strong> or Ubuntu\/Debian<\/strong>, this step-by-step tutorial will walk you through the setup for a secure, organized, and scalable SFTP solution. Let\u2019s get into it and enjoy the process! \ud83d\ude80
Looking for something even easier than this guide?
I created a script to do all this for you on GitHub here<\/a>.\ud83e\udd13 Enjoy!

You can run the following command to download and run the script (requires root\/sudo) directly. No waiting!\u26a1:
curl -sSL https:\/\/raw.githubusercontent.com\/blakelton\/SetupSFTP\/main\/SetupSFTP.sh -o SetupSFTP.sh && chmod +x SetupSFTP.sh && sudo .\/SetupSFTP.sh<\/code>
<\/p>\n\n\n\n

<\/p>\n\n\n\n

\n\n\n\n

Step 1: Installing OpenSSH \ud83d\udee0\ufe0f<\/strong><\/h3>\n\n\n\n

First things first: installing the OpenSSH server. Since SFTP runs on SSH, we\u2019ll need this set up before anything else.<\/p>\n\n\n\n

    \n
  • For AlmaLinux\/CentOS:<\/strong><\/li>\n\n\n\n
  • sudo dnf install openssh-server<\/code><\/li>\n\n\n\n
  • For Ubuntu\/Debian:<\/strong><\/li>\n\n\n\n
  • sudo apt update <\/code><\/li>\n\n\n\n
  • sudo apt install openssh-server<\/code><\/li>\n<\/ul>\n\n\n\n

    Once installed, let\u2019s make sure SSH starts up right away and on boot:<\/p>\n\n\n\n

      \n
    • For AlmaLinux\/CentOS:<\/strong><\/li>\n\n\n\n
    • sudo systemctl start sshd <\/code><\/li>\n\n\n\n
    • sudo systemctl enable sshd<\/code><\/li>\n\n\n\n
    • For Ubuntu\/Debian:<\/strong><\/li>\n\n\n\n
    • sudo systemctl start ssh <\/code><\/li>\n\n\n\n
    • sudo systemctl enable ssh<\/code><\/li>\n<\/ul>\n\n\n\n

      \ud83c\udf89 With SSH installed and running, we\u2019re ready for the next step!<\/em><\/p>\n\n\n\n

      <\/p>\n\n\n\n

      \n\n\n\n

      Step 2: Creating an SFTP Group \ud83d\udc65<\/strong><\/h3>\n\n\n\n

      We\u2019re all about keeping things tidy and secure, so let\u2019s create a dedicated group for our SFTP users. This ensures that only certain users can access SFTP, making management easier.<\/p>\n\n\n\n

        \n
      • For Both AlmaLinux\/CentOS and Ubuntu\/Debian:<\/strong><\/li>\n\n\n\n
      • sudo groupadd sftpusers<\/code><\/li>\n<\/ul>\n\n\n\n

        \ud83d\udcda This step keeps things organized and helps us stay in control of who can access the system.<\/em><\/p>\n\n\n\n

        \n\n\n\n

        Step 3: Creating Your SFTP User \ud83d\udc64<\/strong><\/h3>\n\n\n\n

        Next, let\u2019s create the user who will actually use SFTP. We\u2019ll assign them to the sftpusers<\/code> group we just created and give them a proper shell for flexibility.<\/p>\n\n\n\n

          \n
        • For Both AlmaLinux\/CentOS and Ubuntu\/Debian:<\/strong><\/li>\n\n\n\n
        • sudo useradd -m -G sftpusers -s \/bin\/bash sftpuser <\/code><\/li>\n\n\n\n
        • sudo passwd sftpuser<\/code><\/li>\n\n\n\n
        • <\/li>\n<\/ul>\n\n\n\n

          \ud83d\ude80 Our user is set up and ready to start uploading!<\/em><\/p>\n\n\n\n

          \n\n\n\n

          Step 4: Setting Up the SFTP Directory \ud83d\udcc2<\/strong><\/h3>\n\n\n\n

          To keep things secure and prevent issues with .ssh<\/code> files, we\u2019ll create a dedicated directory for SFTP uploads. This ensures that everything is neatly separated and secure.<\/p>\n\n\n\n

            \n
          • For Both AlmaLinux\/CentOS and Ubuntu\/Debian:<\/strong><\/li>\n\n\n\n
          • sudo mkdir -p \/srv\/sftp\/shared\/ <\/code><\/li>\n\n\n\n
          • sudo chown root:root \/srv\/sftp\/shared\/ <\/code><\/li>\n\n\n\n
          • sudo chmod 755 \/srv\/sftp\/shared\/<\/code><\/li>\n<\/ul>\n\n\n\n
            \n<\/code>\ud83d\udca1 Now, we have a clean, secure location for file transfers!<\/em><\/code><\/pre>\n\n\n\n
            \n\n\n\n
            Step 5: Configuring SSH \u2699\ufe0f<\/strong><\/h3>\n\n\n\n
            Next, we\u2019ll configure SSH to restrict users in the sftpusers<\/code> group to SFTP and prevent them from accessing the entire system.<\/p>\n\n\n\n
              \n
            • For AlmaLinux\/CentOS:<\/strong>
              sudo nano \/etc\/ssh\/sshd_config<\/code><\/li>\n\n\n\n
            • For Ubuntu\/Debian:<\/strong>
              sudo nano \/etc\/ssh\/sshd_config<\/code><\/li>\n<\/ul>\n\n\n\n
              Add the following lines at the end of the file to enforce SFTP access and set the directory to \/srv\/sftp\/shared\/<\/code>:<\/p>\n\n\n\n
              Match Group sftpusers\n    ChrootDirectory \/srv\/sftp\/shared\/\n    ForceCommand internal-sftp\n    AllowTcpForwarding no\n    X11Forwarding no\nPasswordAuthentication yes\nPubkeyAuthentication yes<\/code><\/code><\/pre>\n\n\n\n
              Restart the SSH service to apply the changes:<\/p>\n\n\n\n
                \n
              • For AlmaLinux\/CentOS:<\/strong><\/li>\n\n\n\n
              • sudo systemctl restart sshd<\/code><\/li>\n\n\n\n
              • For Ubuntu\/Debian:<\/strong><\/li>\n\n\n\n
              • sudo systemctl restart ssh<\/code><\/li>\n\n\n\n
              • <\/li>\n<\/ul>\n\n\n\n
                \ud83d\udd10 Your SFTP users are now securely locked into the shared directory!<\/em><\/p>\n\n\n\n
                \n\n\n\n
                Step 6: Configuring the Firewall \ud83d\udd12<\/strong><\/h3>\n\n\n\n
                To ensure that your SFTP server is accessible, we need to open the right ports. Let\u2019s allow SSH (which includes SFTP) through the firewall.<\/p>\n\n\n\n
                  \n
                • For AlmaLinux\/CentOS (Firewalld):<\/strong><\/li>\n\n\n\n
                • sudo firewall-cmd --zone=public --permanent --add-service=ssh <\/code><\/li>\n\n\n\n
                • sudo firewall-cmd --reload<\/code><\/li>\n\n\n\n
                • For Ubuntu\/Debian (UFW):<\/strong><\/li>\n\n\n\n
                • sudo ufw allow OpenSSH <\/code><\/li>\n\n\n\n
                • sudo ufw enable<\/code><\/li>\n\n\n\n
                • <\/li>\n<\/ul>\n\n\n\n
                  \ud83c\udf89 The firewall is configured, and your server is now ready for connections!<\/em><\/p>\n\n\n\n
                  \n\n\n\n
                  Step 7: Testing Your Setup \ud83e\uddea<\/strong><\/h3>\n\n\n\n
                  It\u2019s time to test your configuration and ensure everything is working. Depending on your setup, you\u2019ll use either a local IP address, a hostname, or a domain.<\/p>\n\n\n\n
                  If using a local network<\/strong> (e.g., testing on a home or office network):<\/h4>\n\n\n\n
                  sftp sftpuser@<local-ip-address>
                  <\/pre>\n\n\n\n
                  Example:<\/p>\n\n\n\n
                  sftp sftpuser@192.168.1.100
                  <\/code><\/pre>\n\n\n\n
                  If using a domain name<\/strong> (e.g., a registered domain):<\/h4>\n\n\n\n
                  sftp sftpuser@<your-domain-name>
                  <\/code><\/pre>\n\n\n\n
                  Example:<\/p>\n\n\n\n
                  sftp sftpuser@yourdomain.com
                  <\/code><\/pre>\n\n\n\n
                  This command will attempt to connect to your SFTP server. Once connected, you\u2019ll be able to transfer files securely within the \/srv\/sftp\/shared\/<\/code> directory.<\/p>\n\n\n\n
                  If all went well, you should be able to log in and only access the \/srv\/sftp\/shared<\/code> directory. Success! \ud83d\udc4f<\/p>\n\n\n\n
                  <\/p>\n\n\n\n
                  \n\n\n\n
                  Optional: Changing the SSH Port for Extra Security \ud83d\udd12<\/strong><\/h3>\n\n\n\n
                  For enhanced security, it\u2019s common to change the default SSH port (22) to something less common. Let\u2019s walk through how to do that and how to test the connection.<\/p>\n\n\n\n
                  Step 1: Update the SSH Configuration<\/strong><\/h4>\n\n\n\n
                  Edit the \/etc\/ssh\/sshd_config<\/code> file and change the default port (22) to something like 2222 or 8022:<\/p>\n\n\n\n
                    \n
                  • For AlmaLinux\/CentOS and Ubuntu\/Debian:<\/strong><\/li>\n\n\n\n
                  • sudo nano \/etc\/ssh\/sshd_config<\/code><\/li>\n<\/ul>\n\n\n\n
                    Find the line that says Port 22<\/code> and change it to your desired port:<\/p>\n\n\n\n
                    Port 2222
                    <\/code><\/pre>\n\n\n\n
                    Save the file and restart SSH:<\/p>\n\n\n\n
                      \n
                    • For AlmaLinux\/CentOS:<\/strong><\/li>\n\n\n\n
                    • sudo systemctl restart sshd<\/code><\/li>\n\n\n\n
                    • For Ubuntu\/Debian:<\/strong><\/li>\n\n\n\n
                    • sudo systemctl restart ssh<\/code><\/li>\n<\/ul>\n\n\n\n
                      Step 2: Open the New Port in the Firewall<\/strong><\/h4>\n\n\n\n
                      Make sure the new port is allowed through the firewall:<\/p>\n\n\n\n
                        \n
                      • For AlmaLinux\/CentOS (Firewalld):<\/strong><\/li>\n\n\n\n
                      • sudo firewall-cmd --zone=public --permanent --add-port=2222\/tcp <\/code><\/li>\n\n\n\n
                      • sudo firewall-cmd --reload<\/code><\/li>\n\n\n\n
                      • For Ubuntu\/Debian (UFW):<\/strong><\/li>\n\n\n\n
                      • sudo ufw allow 2222\/tcp <\/code><\/li>\n\n\n\n
                      • sudo ufw reload<\/code><\/li>\n\n\n\n
                      • <\/li>\n<\/ul>\n\n\n\n
                        Step 3: Close Port 22 (Remove the Original Firewall Rules)<\/strong><\/h3>\n\n\n\n
                        Now that the new port is opened, you can close the default SSH port (port 22) for better security.<\/p>\n\n\n\n
                          \n
                        • For AlmaLinux\/CentOS (Firewalld):<\/strong><\/li>\n\n\n\n
                        • sudo firewall-cmd --zone=public --permanent --remove-service=ssh sudo firewall-cmd --reload<\/code><\/li>\n\n\n\n
                        • For Ubuntu\/Debian (UFW):<\/strong><\/li>\n\n\n\n
                        • sudo ufw delete allow OpenSSH <\/code><\/li>\n\n\n\n
                        • sudo ufw reload<\/code><\/li>\n<\/ul>\n\n\n\n
                          Step 4: Restart SSH<\/strong><\/h3>\n\n\n\n
                          Restart the SSH service to apply the port change:<\/p>\n\n\n\n
                            \n
                          • For AlmaLinux\/CentOS:<\/strong><\/li>\n\n\n\n
                          • sudo systemctl restart sshd<\/code><\/li>\n\n\n\n
                          • For Ubuntu\/Debian:<\/strong><\/li>\n\n\n\n
                          • sudo systemctl restart ssh<\/code><\/li>\n<\/ul>\n\n\n\n
                            Step 5: Test the Connection on the New Port<\/strong><\/h3>\n\n\n\n
                            Once the port change is active, use the following command to connect via SFTP using the new port number:<\/p>\n\n\n\n
                            sftp -P 2222 sftpuser@yourdomain.com
                            <\/code><\/pre>\n\n\n\n
                            (Replace 2222<\/code> with your custom port and yourdomain.com<\/code> with your actual domain or IP address.)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"
                            Set up a secure and efficient SFTP server on Linux with this comprehensive guide. Whether you’re using AlmaLinux, CentOS, Ubuntu, or Debian, follow step-by-step instructions to configure a scalable file transfer solution.<\/p>\n","protected":false},"author":1,"featured_media":923,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_regular_price":[],"currency_symbol":[],"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[110,1],"tags":[111,129,148,122,112,133,141,158,140,139,147,146,125,120,131,137,123,118,154,159,162,134,151,149,119,161,150,127,138,124,144,130,155,117,132,115,113,145,156,114,160,143,121,142,135,157,126,153,152,116,128,136],"class_list":["post-921","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guides","category-uncategorized","tag-almalinux","tag-automation","tag-automation-script","tag-bash-script","tag-centos","tag-chroot-jail","tag-custom-ssh-port","tag-data-security","tag-debian","tag-file-sharing","tag-file-transfer","tag-file-transfer-protocol","tag-firewall-configuration","tag-firewalld","tag-ftp-alternative","tag-github-script","tag-group-management","tag-linux","tag-linux-commands","tag-linux-firewall","tag-linux-network","tag-linux-server","tag-linux-tutorial","tag-network-security","tag-openssh","tag-port-forwarding","tag-root-access","tag-scalable-server","tag-secure-file-storage","tag-secure-file-transfer","tag-secure-server","tag-server-firewall","tag-server-management","tag-server-security","tag-server-tutorial","tag-sftp","tag-sftp-server-setup","tag-sftpuser","tag-sftpusers-group","tag-ssh","tag-ssh-access","tag-ssh-configuration","tag-ssh-port-change","tag-ssh-users","tag-step-by-step-guide","tag-sudo-privileges","tag-system-administration","tag-system-security","tag-system-setup","tag-ubuntu","tag-ufw","tag-user-management"],"aioseo_notices":[],"post_slider_layout_featured_media_urls":{"thumbnail":["https:\/\/blake.azuela.info\/wp-content\/uploads\/2024\/10\/Logos-150x150.png",150,150,true],"post_slider_layout_landscape_large":["https:\/\/blake.azuela.info\/wp-content\/uploads\/2024\/10\/Logos-1200x569.png",1200,569,true],"post_slider_layout_portrait_large":["https:\/\/blake.azuela.info\/wp-content\/uploads\/2024\/10\/Logos-1200x569.png",1200,569,true],"post_slider_layout_square_large":["https:\/\/blake.azuela.info\/wp-content\/uploads\/2024\/10\/Logos-1200x569.png",1200,569,true],"post_slider_layout_landscape":["https:\/\/blake.azuela.info\/wp-content\/uploads\/2024\/10\/Logos-600x400.png",600,400,true],"post_slider_layout_portrait":["https:\/\/blake.azuela.info\/wp-content\/uploads\/2024\/10\/Logos-600x569.png",600,569,true],"post_slider_layout_square":["https:\/\/blake.azuela.info\/wp-content\/uploads\/2024\/10\/Logos-600x569.png",600,569,true],"full":["https:\/\/blake.azuela.info\/wp-content\/uploads\/2024\/10\/Logos.png",1912,569,false]},"_links":{"self":[{"href":"https:\/\/blake.azuela.info\/index.php\/wp-json\/wp\/v2\/posts\/921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blake.azuela.info\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blake.azuela.info\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blake.azuela.info\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blake.azuela.info\/index.php\/wp-json\/wp\/v2\/comments?post=921"}],"version-history":[{"count":10,"href":"https:\/\/blake.azuela.info\/index.php\/wp-json\/wp\/v2\/posts\/921\/revisions"}],"predecessor-version":[{"id":1024,"href":"https:\/\/blake.azuela.info\/index.php\/wp-json\/wp\/v2\/posts\/921\/revisions\/1024"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blake.azuela.info\/index.php\/wp-json\/wp\/v2\/media\/923"}],"wp:attachment":[{"href":"https:\/\/blake.azuela.info\/index.php\/wp-json\/wp\/v2\/media?parent=921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blake.azuela.info\/index.php\/wp-json\/wp\/v2\/categories?post=921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blake.azuela.info\/index.php\/wp-json\/wp\/v2\/tags?post=921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}