I am trying to purchase a data stream that is sent hourly/daily/weekly from a data provider. They are telling me that they deliver data via SFTP push. I am concerned with security. What precautions should I take to allow files to get transferred to my server via push?

These are the things that I am assuming I need to do:

  1. Create a folder where the files are sent
  2. Create an SSH key and user for my server
  3. Limit that user access to that one and only folder

Are these correct? I would appreciate a full detailed example of how to set up a secure SFTP push onto my server (linux).

2 Answers 2


SFTP is more or less "built-in" on standard Linux installs of openssh-server I think. So if you have an SSH server running, you're mostly ready, but:

  1. Look at /etc/ssh/sshd.config and make sure at least root can't login using a password (keys only for root). You really should disable password login via SSH entirely and only use keys. Also make sure any forwarding options are disabled.

  2. Also consider specifying a group and enabling ChrootDirectory

  3. Setup and monitor fail2ban to protect your sshd from repeated password guessing attempts. You will get them. Or consider whitelisting IP addresses if possible, and/or firewalling off IP ranges of countries from which access will not ever be needed.

  4. Create an account where the files will be received. If you specified a group for chroot in step 2, specify that group when you add the user.

  5. Change this accounts's shell to /sbin/nologin - that way they can't get a shell and are restricted to SFTP only.

  6. Create an SSH key for that account.

  7. Adjust permissions on the account's home folder such that nothing is writeable but a drop folder where you want to receive the files. You may not need to worry too much about this if you're doing ChrootDirectory.

  8. Set a disk quota for this user so the account can't maliciously fill up your disk.

  9. Setup a cron job or similar mechanism to periodically scan the folder and copy out files.

  1. Whitelist originating I.P.s

and them, for the specific SFTP configuration, it seems this sibling question on serverfault.com has a more complete answer than I'd be able to provide:


I reached there trying to figure out how to restrict the login to use the SFTP subsystem only, and not be able to get an ssh-shell - that is "5." anyway.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .