How to Fix SFTP Access Problems on Your VPS

SFTP (SSH File Transfer Protocol) is the standard way to securely transfer files to and from your VPS. When it stops working, you can’t upload or download files, which can halt your entire workflow. This guide walks you through the most common causes of SFTP connection failures and provides clear, actionable fixes to get you back online.

What You’ll Need

• SSH access to your VPS (via a terminal or SSH client like PuTTY)
• Your VPS’s IP address and login credentials
• An SFTP client (e.g., FileZilla, WinSCP, or the command line)
• Sudo/root privileges on the VPS to make configuration changes

Step-by-Step

1. Verify basic connectivity. First, confirm the VPS is reachable. From your local machine, run ping your-vps-ip (replace with your actual IP). If ping fails, the server may be down or the network is blocked. Next, test SSH on port 22: ssh root@your-vps-ip. If SSH works, the issue is SFTP-specific. If SSH fails, check your firewall rules and that the SSH service is running.
2. Check the SSH service status. On the VPS, run sudo systemctl status sshd (or ssh on some systems). Ensure it shows active (running). If not, start it with sudo systemctl start sshd and enable it to start on boot with sudo systemctl enable sshd.
3. Confirm the SFTP subsystem is enabled. SSH config controls SFTP. Open the SSH daemon config file: sudo nano /etc/ssh/sshd_config. Look for a line like Subsystem sftp internal-sftp (or /usr/lib/openssh/sftp-server). If it’s commented out (starts with #), uncomment it. If it’s missing, add it. Save the file and restart SSH: sudo systemctl restart sshd.
4. Check user permissions and shell. SFTP users need a valid shell (like /bin/bash) or a restricted shell (like /bin/false if you want SFTP-only). Check the user’s shell: grep username /etc/passwd. If it’s /usr/sbin/nologin or /bin/false, SFTP may be blocked. For SFTP-only access, you can use internal-sftp with a Match Group directive in sshd_config. Also ensure the user has read/write permissions on their home directory and the target directories.
5. Inspect firewall rules. On the VPS, check if a firewall (ufw, firewalld, iptables) is blocking port 22. For ufw: sudo ufw status. If port 22 is not allowed, run sudo ufw allow 22/tcp. For firewalld: sudo firewall-cmd --list-all and add the service with sudo firewall-cmd --permanent --add-service=ssh && sudo firewall-cmd --reload. Also check cloud provider security groups (AWS, DigitalOcean, etc.) – they often have separate inbound rules.
6. Test with verbose output. From your local machine, run an SFTP command with verbose logging to see exactly where it fails: sftp -vvv user@your-vps-ip. Look for lines like “Connection refused”, “Permission denied”, or “subsystem request failed”. This will point you to the next step.
7. Check disk space and inodes. A full disk can cause SFTP to fail. On the VPS, run df -h to check disk usage and df -i for inodes. If either is at 100%, free up space or delete files. This is a common hidden cause.
8. Verify SSH key permissions (if using keys). If you use SSH keys, the private key on your local machine must have strict permissions (chmod 600). On the server, the ~/.ssh directory should be 700 and authorized_keys should be 600. Incorrect permissions can cause authentication to fail silently.
9. Check SELinux (if enabled). On CentOS/RHEL/Fedora, SELinux can block SFTP. Check with getenforce. If it’s Enforcing, try setting it to Permissive temporarily: sudo setenforce 0 and test. If that fixes it, you need to adjust SELinux policies – a common fix is sudo setsebool -P ssh_sysadm_login 1 or restorecon on directories. Consult your distribution’s SELinux documentation.
10. Review logs. The SSH logs are your best friend. On most systems, check sudo tail -f /var/log/auth.log (Debian/Ubuntu) or sudo tail -f /var/log/secure (RHEL/CentOS). Attempt an SFTP connection and watch the log for errors like “subsystem request failed” or “Connection closed by”. This will often reveal the exact cause.

Common Mistakes

• Forgetting to restart SSH after config changes. Always run sudo systemctl restart sshd after editing sshd_config.
• Using the wrong port. If you changed the SSH port, your SFTP client must use that port, not 22.
• Typing the password incorrectly. SFTP uses the same password as SSH. Ensure Caps Lock is off and try again.
• Blocking port 22 in multiple firewalls. Check both the OS firewall and the cloud provider’s security group.
• Setting incorrect permissions on home directory. The user’s home directory and its parent directories must be traversable (execute permission) by the user. A common mistake is chmod 777 on home, which is insecure but works; the correct is 755 or 700.

Tips

• Use SFTP over SSH. SFTP runs over the SSH protocol, so any SSH configuration that works will also work for SFTP. Keep SSH secure and SFTP will follow.
• Set up SFTP-only chroot jail. For security, you can restrict SFTP users to their home directory using ChrootDirectory in sshd_config. This is useful for shared hosting.
• Use key-based authentication. Keys are more secure than passwords and often more reliable. Generate a key pair with ssh-keygen and copy the public key to the server.
• Test with a different client. If one SFTP client fails, try another (e.g., FileZilla vs. WinSCP) to rule out client-side issues.
• Keep your system updated. Regularly run sudo apt update && sudo apt upgrade (Debian/Ubuntu) or sudo yum update (RHEL) to patch security vulnerabilities that could affect SSH.

Troubleshooting

If you’ve followed the steps and still have issues, here’s what to try next:

• If you get “Connection refused”: The SSH service is not running or the port is closed. Check the service status and firewall rules again. Also verify the VPS is actually up.
• If you get “Permission denied”: Authentication is failing. Double-check your username and password. If using keys, ensure the public key is correctly placed in ~/.ssh/authorized_keys and permissions are correct. Try using password authentication temporarily to isolate the issue.
• If you get “subsystem request failed”: The SFTP subsystem is not configured. Revisit step 3 and ensure the Subsystem line is correct and uncommented.
• If the connection times out: Likely a firewall or network issue. Check all firewalls (local and cloud), and also check if the ISP is blocking port 22 (rare). Try connecting from a different network (e.g., mobile hotspot).
• If you can connect but see no files: The user may be chrooted to an empty directory, or the home directory is misconfigured. Check the user’s home in /etc/passwd and the ChrootDirectory setting.
• If all else fails: Check the system logs for any other errors. You can also temporarily disable SELinux (if enabled) and test. If that fixes it, you’ll need to configure SELinux properly. As a last resort, consider rebooting the VPS – sometimes a simple restart resolves transient issues.

Frequently Asked Questions

Why can I SSH but not SFTP?

SSH and SFTP use the same port, but SFTP requires the SFTP subsystem to be enabled in the SSH server configuration. If SSH works but SFTP fails, check the Subsystem sftp line in /etc/ssh/sshd_config.

How do I allow SFTP through the firewall?

SFTP uses the same port as SSH (default 22). Allow port 22/tcp in your firewall. For ufw: sudo ufw allow 22/tcp. For firewalld: sudo firewall-cmd --permanent --add-service=ssh. Also check your cloud provider’s security group.

Can I restrict SFTP users to their home directory?

Yes, use the ChrootDirectory directive in sshd_config. Create a Match Group sftpusers section, set ChrootDirectory %h, and use ForceCommand internal-sftp. This is a common setup for secure file sharing.

What does “Connection closed by remote host” mean?

This often indicates an authentication failure or a server-side issue. Check the SSH logs on the server for details. It could also be caused by a full disk or incorrect permissions.

How do I change the SFTP port?

You don’t change SFTP’s port separately; it uses the SSH port. To change the port, edit the Port line in sshd_config, restart SSH, and update your SFTP client to use the new port.

Is SFTP the same as FTPS?

No. SFTP (SSH File Transfer Protocol) runs over SSH and uses port 22. FTPS (FTP over SSL/TLS) uses FTP with an SSL layer, typically on ports 21 and 990. They are different protocols and are not interchangeable.

Related

• Nothing Phone 2 Waterproof? IP54 Rating Explained
• Satellite Internet Equipment & Installation Guide
• Infinix GT 20 Pro vs AI Nova 2 Ultra 5G: Which Fits?