ProFTPD SFTP Setup: Switch from FTP in Steps

This guide shows you how to configure ProFTPD to serve files over SFTP (SSH File Transfer Protocol) instead of plain FTP. SFTP runs over an encrypted SSH connection, so your login credentials and data are protected from eavesdropping. You’ll need root access to your server and an existing ProFTPD installation.

What You’ll Need

• A Linux/Unix server with ProFTPD installed (e.g., via apt install proftpd or yum install proftpd).
• Root or sudo access to edit configuration files and restart services.
• An SSH server (like OpenSSH) already running on the same host, or the ability to install one. SFTP in ProFTPD uses its own internal SSH implementation, so you don’t need OpenSSH, but you do need the mod_sftp module.

Step-by-Step

1. Install the SFTP module. ProFTPD ships with mod_sftp in most distributions. If it’s not already installed, install the package that includes it. On Debian/Ubuntu, this is usually proftpd-mod-sftp. On RHEL/CentOS, it may be included in the main proftpd package. Check with proftpd -l to see if mod_sftp is listed.
2. Back up your configuration. Copy your current proftpd.conf to a safe place: cp /etc/proftpd/proftpd.conf /etc/proftpd/proftpd.conf.bak.
3. Disable plain FTP (optional but recommended). To stop the insecure FTP protocol entirely, comment out or remove the LoadModule mod_ftp.c line in your config. If you want to keep FTP for legacy clients, skip this step.
4. Load the SFTP module. Add the following line to your proftpd.conf (usually near the top): LoadModule mod_sftp.c. If you used a separate package, the module may already be loaded via an include file in /etc/proftpd/modules.conf.
5. Create an SFTP configuration block. Add a new <IfModule mod_sftp.c> section. Inside it, you’ll define the SFTP engine, port, and authentication methods. A minimal working block looks like this:

   <IfModule mod_sftp.c>
     SFTPEngine on
     SFTPLog /var/log/proftpd/sftp.log
     Port 2222
     SFTPHostKey /etc/ssh/ssh_host_rsa_key
     SFTPHostKey /etc/ssh/ssh_host_ecdsa_key
     SFTPAuthorizedUserKeys file:/etc/ssh/authorized_keys/%u
     SFTPAuthMethods publickey password
   </IfModule>
       

   Adjust the host key paths to match your system. You can generate new keys with ssh-keygen if needed.

6. Set the listen port. The Port directive inside the SFTP block tells ProFTPD to listen on that port for SFTP connections. Port 2222 is common to avoid conflicting with OpenSSH on port 22. If you want to use port 22, you must stop OpenSSH or move it to another port.
7. Configure authentication. The SFTPAuthMethods line allows both password and public key authentication. If you want only keys, remove password. For password auth, ProFTPD will use the system’s PAM or shadow files as usual.
8. Restart ProFTPD. After saving your changes, restart the service: systemctl restart proftpd (or service proftpd restart). Check the status with systemctl status proftpd to ensure it started without errors.
9. Test the connection. From a client machine, use an SFTP client (like sftp command, FileZilla, or WinSCP) to connect to sftp://your-server:2222. Log in with a system user. If you set up keys, test that too.

Common Mistakes

• Forgetting to load the module. If you don’t load mod_sftp, the SFTPEngine directive will be ignored, and you’ll still be on plain FTP.
• Using the wrong host key path. ProFTPD needs read access to the key files. If the paths are wrong, the module will fail to start. Use absolute paths and check permissions (usually root:root, 600).
• Port conflict with OpenSSH. If you try to use port 22 while OpenSSH is running, ProFTPD will fail to bind. Use a different port or stop OpenSSH.
• Not disabling FTP. If you leave FTP enabled, clients can still connect via port 21, which defeats the purpose. Comment out the FTP module or change the default port to something else.
• Firewall blocking the new port. Don’t forget to open the SFTP port (e.g., 2222) in your firewall (ufw, iptables, security groups).

Tips

• Use public key authentication for better security. Generate a key pair on the client and add the public key to ~/.ssh/authorized_keys on the server.
• Set the SFTPCompression directive to on to speed up transfers on slow links.
• Keep your host keys in a dedicated directory like /etc/proftpd/keys to avoid mixing with OpenSSH keys.
• Use SFTPAuthorizedUserKeys file:/etc/ssh/authorized_keys/%u to keep per-user key files, which is cleaner than a single file.
• Log SFTP activity to a separate file (as shown) to make troubleshooting easier.

Troubleshooting

• ProFTPD fails to start. Check the error log at /var/log/proftpd/proftpd.log. Common causes: missing host key files, permission errors, or port already in use. Run proftpd -t to test the configuration syntax.
• Client gets “Connection refused”. Ensure the firewall allows the port and that ProFTPD is listening on that port. Use netstat -tulpn | grep 2222 to verify.
• Authentication fails. If password auth fails, check that PAM is configured correctly for ProFTPD. For public keys, verify the key file permissions (the authorized_keys file should be 600 and owned by the user). Also ensure the SFTPAuthorizedUserKeys path is correct.
• SFTP works but FTP still works. You didn’t disable the FTP module. Comment out LoadModule mod_ftp.c or change the default Port 21 to something else.
• Slow transfers. Enable compression with SFTPCompression on and check network latency. Also ensure you’re using a modern cipher by setting SFTPCiphers to a strong list.

Frequently Asked Questions

Can I run both FTP and SFTP at the same time?

Yes, you can. Just leave the FTP module loaded and keep the default Port 21 active, while also enabling the SFTP engine on a different port. This allows legacy clients to use FTP, but new clients can use SFTP.

Do I need OpenSSH to use SFTP with ProFTPD?

No. ProFTPD’s mod_sftp implements the SFTP protocol itself, so it doesn’t rely on OpenSSH. However, you can reuse the SSH host keys from OpenSSH to avoid generating new ones.

What port should I use for SFTP?

Port 22 is the standard for SSH/SFTP, but if OpenSSH is already using it, use a different port like 2222. Some firewalls block non-standard ports, so choose one that is allowed or update the firewall.

How do I set up public key authentication?

Generate a key pair on the client with ssh-keygen, then copy the public key to the server’s ~/.ssh/authorized_keys for the user. In ProFTPD, set SFTPAuthorizedUserKeys file:/home/%u/.ssh/authorized_keys or a central directory.

Is SFTP the same as FTPS?

No. SFTP is a file transfer protocol over SSH, while FTPS is FTP over TLS/SSL. They are not compatible. This guide covers SFTP only.

How do I change the SFTP port after setup?

Edit the Port directive inside the <IfModule mod_sftp.c> block, then restart ProFTPD. Remember to update your firewall and client connections.

Related

• AI Voice and Likeness Cloning: Consent and Misuse
• Url2png Alternatives for Competitor Page Monitoring
• Samsung Note 7 Users: Was There an Extra $100 Phone Offer?