SFTP

What is SFTP?

SFTP (SSH File Transfer Protocol) is a protocol for transferring, retrieving and managing files in encrypted form, running as a subsystem inside a secure SSH connection. Commands, file names, contents and credentials all travel through the same tunnel, protected by encryption and usually over a single TCP port (22). In OT environments SFTP is the common way to exchange configurations, log files, firmware, backups and recipes between systems without them being intercepted or tampered with on the way.

🧠 How does SFTP work?

SFTP is not FTP tunnelled through SSH but a binary protocol in its own right. A session runs in four steps:

1. Establish the SSH connection - the client connects to the server, verifies the host key and negotiates encryption and key exchange.
2. Authentication - the user logs in with an SSH key, password, certificate or a combination of these.
3. Start the subsystem - the client requests the sftp subsystem. Client and server exchange SSH_FXP_INIT and SSH_FXP_VERSION messages and agree on the protocol version.
4. File operations - the client opens files (SSH_FXP_OPEN), receives a handle and reads or writes blocks with SSH_FXP_READ and SSH_FXP_WRITE. Every request carries its own ID, so several requests can be in flight at once.

Because SFTP works with handles and offsets, it can do more than copy: list directories, rename, delete, change permissions and resume interrupted transfers. That sets it apart from the older SCP, which only copies. Since OpenSSH 9.0 (April 2022) the scp command itself uses the SFTP protocol by default; the legacy scp/rcp mode is only reachable with the -O option.

📜 Is SFTP an official standard?

Formally, no. The IETF secsh working group described SFTP in a series of Internet-Drafts between 2001 and 2006, but the work stopped at draft 13 (July 2006) without ever becoming an RFC. The underlying SSH-2 protocol was standardised, in RFC 4250 to 4254 (2006).

OpenSSH fills the gaps with extensions such as posix-rename@openssh.com. For interoperability between vendors, version 3 is therefore the safe baseline.

🔍 What is the difference between SFTP, FTP and FTPS?

The practical benefit of a single port is significant in OT: a firewall rule between zones can allow exactly one connection from a fixed source to a fixed destination, without opening a range of dynamic data ports.

🏭 What is SFTP used for in industrial environments?

• Logs and process data going up - export files from SCADA or a historian are sent to a server in the DMZ, where MES or quality systems collect them
• Recipes and orders going down - recipe files or production orders are staged in a fixed location and picked up by the production line
• Staging firmware and project files - vendors upload updates to an intermediate server; the administrator checks them and passes them on via an engineering station. The download to a PLC usually goes through the manufacturer’s engineering software, not through SFTP
• Backups - configurations of switches, firewalls and servers are written away periodically by script
• Remote maintenance - vendors exchange files via a bastion host or jump server instead of a direct connection into the process network

Following the Purdue Model, this traffic does not run directly between the office and process networks. Both sides connect to an SFTP server in the intermediate zone, so no single connection crosses the zone boundary in one hop.

🔧 How do you set up an SFTP server securely?

A default OpenSSH server often gives users with an SFTP account a full shell as well. In OT you want to restrict that. A proven approach:

1. Separate group - create a group, for example sftponly, for integrations and vendors.
2. Allow SFTP only - in sshd_config, use a Match Group sftponly block with ForceCommand internal-sftp, and set AllowTcpForwarding no and X11Forwarding no.
3. Lock users into a directory - with ChrootDirectory users see only their own directory. Every directory in that path must be owned by root and must not be writable by group or others.
4. Restrict permissions - internal-sftp -R makes an account read-only; with -p or -P you allow or deny specific requests. This lets you build an upload-only folder for recipes or a download-only folder for logs.
5. Keys instead of passwords - use Ed25519 keys with a passphrase for people, and separate non-interactive keys for scripts, restricted to a single source IP. Disable PasswordAuthentication. Follow the principle of least privilege: one key per integration.
6. Log transfers - by default sftp-server only logs errors. With -l INFO, opened, read and written files are recorded; forward this via syslog to your SIEM. With a chroot, the syslog daemon needs an extra /dev/log socket inside the chroot directory, otherwise those entries are lost.
7. Verify host keys - record the server’s fingerprint in the client’s known_hosts, or use SSH certificates. Without this check a man-in-the-middle attack is possible.

For scripted transfers sftp -b is useful: in batch mode the session stops as soon as a command fails, so a half-sent file is not left behind unnoticed. Let the receiver process a file only after it has been uploaded under a temporary name and then renamed, and compare a SHA-256 hash to check data integrity.

🔐 Which security risks remain?

SFTP protects the transport, not the content. An infected file arrives just as encrypted as a clean one. So pay attention to:

• Content inspection - scan uploaded files for malware before they enter the process network
• Vulnerabilities in SSH - Terrapin (CVE-2023-48795) and regreSSHion (CVE-2024-6387) also affected SFTP servers; keep OpenSSH and device firmware up to date through patch management
• Future-proof encryption - since version 9.0 OpenSSH has used a hybrid post-quantum key exchange (sntrup761x25519) by default, and since 10.0 (April 2025) mlkem768x25519-sha256, as protection against harvest now, decrypt later (post-quantum cryptography)
• One-way traffic - if data must strictly flow outward only, a data diode offers stronger guarantees than SFTP, because SFTP is always bidirectional
• Shared accounts - one account for all vendors makes an audit impossible; give each party its own account and combine this with access control, RBAC and MFA for interactive access

SFTP helps meet requirements in IEC 62443-3-3, such as communication integrity (SR 3.1), information confidentiality (SR 4.1) and use of cryptography (SR 4.3), and supports the information transfer controls in ISO 27001. Organisations covered by NIS2 and the Dutch Cybersecurity Act (in force since 15 August 2026) must also take appropriate measures for secure communication. SFTP is a building block there, not a tick in a box: compliance only follows from combining it with network segmentation, key management, logging and access policy. Good transport security is only one layer.

❓ Frequently asked questions

Which port does SFTP use?

SFTP uses TCP port 22 by default, the same port as SSH itself. Many organisations run SFTP on a separate server or port so that file transfer and shell administration stay apart. Unlike FTP and FTPS, SFTP needs no separate data ports.

Is SFTP the same as FTPS?

No, SFTP and FTPS are different protocols. FTPS is classic FTP with TLS encryption and X.509 certificates, whereas SFTP is a subsystem of SSH using SSH keys. Clients and servers for one protocol do not work with the other, although many programs support both.

Can a PLC receive files directly via SFTP?

A few modern controllers, HMI panels and industrial routers have a built-in SFTP client or server, but most PLCs do not. The usual pattern is that SFTP brings files to an engineering station or intermediate server, after which the manufacturer’s engineering software loads them into the PLC. Always check the vendor documentation to see which protocols a device supports.

Is SFTP secure enough for transferring files into the OT network?

SFTP secures the transport well, but it does not check what is inside a file. For files entering the process network, combine SFTP with an intermediate zone, malware scanning, hash verification and approval by an administrator. For strictly outbound data, a data diode is a stronger alternative.

What is the difference between SFTP and SCP?

SCP only copies files, whereas SFTP can also list directories, rename and delete files and resume interrupted transfers. Since OpenSSH 9.0 the scp command uses the SFTP protocol under the hood by default. Both share the same SSH authentication and encryption.

How do you automate SFTP transfers securely?

Automate SFTP with a dedicated key per integration, restricted to one source IP and one directory, and without shell access. Use batch mode (sftp -b) so that an error stops the session, upload under a temporary name and rename only afterwards. Log every transfer centrally so that anomalies stand out.

📌 In summary

SFTP transfers files in encrypted form inside an SSH connection, over a single port and with strong key-based authentication. It never became an RFC, but version 3 is the de facto standard in practice. In OT, SFTP works best through a server in the intermediate zone, with a dedicated account per integration, a chrooted directory per user and central logging.

SFTP is the preferred protocol for secure file transfer in OT environments, provided you combine it with segmentation, key management, logging and inspection of the content being transferred.