1SFTP-SERVER(8)            BSD System Manager's Manual           SFTP-SERVER(8)
2

NAME

4     sftp-server — OpenSSH SFTP server subsystem
5

SYNOPSIS

7     sftp-server [-ehR] [-d start_directory] [-f log_facility] [-l log_level]
8                 [-P denied_requests] [-p allowed_requests] [-u umask]
9                 [-m force_file_perms]
10     sftp-server -Q protocol_feature
11

DESCRIPTION

13     sftp-server is a program that speaks the server side of SFTP protocol to
14     stdout and expects client requests from stdin.  sftp-server is not in‐
15     tended to be called directly, but from sshd(8) using the Subsystem op‐
16     tion.
17
18     Command-line flags to sftp-server should be specified in the Subsystem
19     declaration.  See sshd_config(5) for more information.
20
21     Valid options are:
22
23     -d start_directory
24             Specifies an alternate starting directory for users.  The path‐
25             name may contain the following tokens that are expanded at run‐
26             time: %% is replaced by a literal '%', %d is replaced by the home
27             directory of the user being authenticated, and %u is replaced by
28             the username of that user.  The default is to use the user's home
29             directory.  This option is useful in conjunction with the
30             sshd_config(5) ChrootDirectory option.
31
32     -e      Causes sftp-server to print logging information to stderr instead
33             of syslog for debugging.
34
35     -f log_facility
36             Specifies the facility code that is used when logging messages
37             from sftp-server.  The possible values are: DAEMON, USER, AUTH,
38             LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
39             The default is AUTH.
40
41     -h      Displays sftp-server usage information.
42
43     -l log_level
44             Specifies which messages will be logged by sftp-server.  The pos‐
45             sible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DE‐
46             BUG1, DEBUG2, and DEBUG3.  INFO and VERBOSE log transactions that
47             sftp-server performs on behalf of the client.  DEBUG and DEBUG1
48             are equivalent.  DEBUG2 and DEBUG3 each specify higher levels of
49             debugging output.  The default is ERROR.
50
51     -P denied_requests
52             Specifies a comma-separated list of SFTP protocol requests that
53             are banned by the server.  sftp-server will reply to any denied
54             request with a failure.  The -Q flag can be used to determine the
55             supported request types.  If both denied and allowed lists are
56             specified, then the denied list is applied before the allowed
57             list.
58
59     -p allowed_requests
60             Specifies a comma-separated list of SFTP protocol requests that
61             are permitted by the server.  All request types that are not on
62             the allowed list will be logged and replied to with a failure
63             message.
64
65             Care must be taken when using this feature to ensure that re‐
66             quests made implicitly by SFTP clients are permitted.
67
68     -Q protocol_feature
69             Queries protocol features supported by sftp-server.  At present
70             the only feature that may be queried is “requests”, which may be
71             used to deny or allow specific requests (flags -P and -p respec‐
72             tively).
73
74     -R      Places this instance of sftp-server into a read-only mode.  At‐
75             tempts to open files for writing, as well as other operations
76             that change the state of the filesystem, will be denied.
77
78     -u umask
79             Sets an explicit umask(2) to be applied to newly-created files
80             and directories, instead of the user's default mask.
81
82     -m force_file_perms
83             Sets explicit file permissions to be applied to newly-created
84             files instead of the default or client requested mode.  Numeric
85             values include: 777, 755, 750, 666, 644, 640, etc.  Using both -m
86             and -u switches makes the umask (-u) effective only for newly
87             created directories and explicit mode (-m) for newly created
88             files.
89
90     On some systems, sftp-server must be able to access /dev/log for logging
91     to work, and use of sftp-server in a chroot configuration therefore re‐
92     quires that syslogd(8) establish a logging socket inside the chroot di‐
93     rectory.
94

SEE ALSO

96     sftp(1), ssh(1), sshd_config(5), sshd(8)
97
98     T. Ylonen and S. Lehtinen, SSH File Transfer Protocol, draft-ietf-secsh-
99     filexfer-02.txt, October 2001, work in progress material.
100

HISTORY

102     sftp-server first appeared in OpenBSD 2.8.
103

AUTHORS

105     Markus Friedl <markus@openbsd.org>
106
107BSD                              July 27, 2021                             BSD