Theme

SFTP and SCP: secure file transfer over SSH ​

SFTP (SSH File Transfer Protocol) and SCP (Secure Copy Protocol) are both secure file transfer protocols carried by SSH-2 (Secure Shell version 2). Both provide encrypted and authenticated transfers between systems, but they are not the same thing, and neither is the same as FTP.

SFTP ​

SFTP is a robust and versatile protocol:

  • it runs as a subsystem over an encrypted SSH connection, typically on port 22;
  • it inherits the strong encryption and authentication of SSH;
  • it supports a wide range of operations: upload, download, resume of interrupted transfers, and remote file and directory manipulation (list, rename, delete, permissions, and more).

One port, one connection, and a feature set that most other file transfer protocols lack.

SCP ​

SCP is designed specifically to copy files between hosts. Strictly speaking it is not an SSH subsystem: the client asks the server to execute the scp command over the SSH exec channel, and the two ends then speak the SCP protocol over it. It uses the same authentication and security mechanisms as SSH.

Compared with SFTP:

  • SCP is simple to use in scripts, but lacks most of SFTP's features;
  • SFTP offers more functionality, including resuming interrupted transfers and operating on the remote file system.

WARNING

A poison pill. To fill the functionality gap, some SCP clients open a parallel SSH shell to perform the operations SCP lacks, which creates a potential side channel for attacks. If all you need is secure file transfer and an SCP client asks for a shell, the safest choice is to drop SCP and use SFTP. Do not grant the shell just because SCP asks for it, unless you know exactly how to keep it safe.

The channels of SSH-2 ​

SFTP and SCP are not all that SSH-2 carries. Over one connection a client can ask for:

  1. file transfer: the sftp subsystem, or scp as a command;
  2. remote command execution (exec): running a single command on the remote system;
  3. an interactive shell.

This flexibility makes SSH-2 a powerful tool for remote administration and file transfer, and, like every powerful tool, it demands careful configuration by a knowledgeable administrator.

Syncplify Server! offers all of them, and each one is a separate permission on the user account (ssh2_sftp, ssh2_scp, ssh2_command, ssh2_shell), so you grant only what a user needs. The shell of Syncplify Server! is a virtual shell: a small, fixed set of commands interpreted by the server on the user's own virtual file system, which never starts a process on the host operating system. The manual describes it in The SSH Shell subsystem.

Security considerations ​

Both SFTP and SCP offer significant advantages over the traditional, unencrypted protocols:

  • strong encryption protects the data in transit;
  • authentication mechanisms verify the identity of both the client and the server;
  • integrity protection prevents undetected modifications during the transfer.

Choosing between SFTP and SCP ​

  • Functionality: SFTP offers more advanced file management features.
  • Compatibility: SCP may be the only choice in old environments where SFTP support is limited or absent.
  • Fitness: in most modern scenarios, SFTP is the preferred choice, for its broader feature set and universal support.

For the other family of protocols, see Understanding FTP and its variants.