1SFTP-SERVER(8) BSD System Manager's Manual SFTP-SERVER(8)
2
4 sftp-server — OpenSSH SFTP server subsystem
5
7 sftp-server [-ehR] [-d start_directory] [-f log_facility] [-l log_level]
8 [-P denied_requests] [-p allowed_requests] [-u umask]
9 [-m force_file_perms]
10 sftp-server -Q protocol_feature
11
13 sftp-server is a program that speaks the server side of SFTP protocol to
14 stdout and expects client requests from stdin. sftp-server is not in‐
15 tended to be called directly, but from sshd(8) using the Subsystem op‐
16 tion.
17 Command-line flags to sftp-server should be specified in the Subsystem
19 declaration. See sshd_config(5) for more information.
20 Valid options are:
22 -d start_directory
24 Specifies an alternate starting directory for users. The path‐
25 name may contain the following tokens that are expanded at run‐
26 time: %% is replaced by a literal '%', %d is replaced by the home
27 directory of the user being authenticated, and %u is replaced by
28 the username of that user. The default is to use the user's home
29 directory. This option is useful in conjunction with the
30 sshd_config(5) ChrootDirectory option.
31 -e Causes sftp-server to print logging information to stderr instead
33 of syslog for debugging.
34 -f log_facility
36 Specifies the facility code that is used when logging messages
37 from sftp-server. The possible values are: DAEMON, USER, AUTH,
38 LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
39 The default is AUTH.
40 -h Displays sftp-server usage information.
42 -l log_level
44 Specifies which messages will be logged by sftp-server. The pos‐
45 sible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DE‐
46 BUG1, DEBUG2, and DEBUG3. INFO and VERBOSE log transactions that
47 sftp-server performs on behalf of the client. DEBUG and DEBUG1
48 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of
49 debugging output. The default is ERROR.
50 -P denied_requests
52 Specifies a comma-separated list of SFTP protocol requests that
53 are banned by the server. sftp-server will reply to any denied
54 request with a failure. The -Q flag can be used to determine the
55 supported request types. If both denied and allowed lists are
56 specified, then the denied list is applied before the allowed
57 list.
58 -p allowed_requests
60 Specifies a comma-separated list of SFTP protocol requests that
61 are permitted by the server. All request types that are not on
62 the allowed list will be logged and replied to with a failure
63 message.
64 Care must be taken when using this feature to ensure that re‐
66 quests made implicitly by SFTP clients are permitted.
67 -Q protocol_feature
69 Queries protocol features supported by sftp-server. At present
70 the only feature that may be queried is “requests”, which may be
71 used to deny or allow specific requests (flags -P and -p respec‐
72 tively).
73 -R Pla