All chapters

SFTP and FTP

Files reach a site three ways: the file manager in the browser, SFTP, which is on from the start, and FTPS, which an administrator can switch on. Plain, unencrypted FTP is not offered at all: it sends the password across the internet in clear text.

Where the settings are

Open a site and its FTP tab, titled File transfer. It shows exactly what a client such as FileZilla needs: protocol, host (the site's own name), port and username, each with a Copy button, and the same as one sftp command for a terminal. The port is 2222, not the usual 22: port 22 is the server's own SSH, and customers are served by a separate, locked-down SFTP service.

The site's FTP tab, titled File transfer: one SFTP key, My laptop, with its fingerprint, and the connection settings: host example.com, port 2222, username u1.
The File transfer tab on the test machine, with one key added.

Port 2222 is open in this server's own firewall. If the server sits behind a cloud provider's firewall, 2222 has to be allowed there too; until it is, a client waits and times out with nothing in any log. cpleks can neither see nor change that firewall.

Your own login: a key

The hosting account's own SFTP login uses a key, not a password.

  1. Under SFTP keys, press Add a key.
  2. Give it a name you will recognise (My laptop) and paste your public key: the file ending in .pub, printed by cat ~/.ssh/id_ed25519.pub. If you have none yet, ssh-keygen -t ed25519 makes a pair. The panel refuses a private key if you paste one by mistake.
  3. Press Add it, then connect: 
    sftp -P 2222 <username shown on the tab>@<your server>

You land in your own home and cannot see the rest of the server. Put the site's files in its folder, public_html for the first site.

Extra accounts with a password

For a designer, a deploy script or a contractor: a second login on the same hosting account, with a password instead of a key, that you can delete on its own. Files they upload are yours, exactly as if you had uploaded them.

  1. Under Accounts, press Add an account.
  2. Who it is for: a note for you (The designer). The login name is assigned when the account is made.
  3. Folder to start in: a folder directly inside the home where their session opens, for example public_html. It is a starting point, not a fence: they can move around the rest of this hosting account's home, and nothing outside it.
  4. Type the password twice and press Create it. The toast names the login; hand over the password you typed, because it is not shown again.
The form for adding an extra SFTP account: who it is for, the folder to start in and the password.
Adding an account with a password.

Change password and Delete sit on each row. Deleting an account removes the login; nothing it uploaded is removed.

FTPS (FTP over TLS)

For customers whose tools only speak FTP. An administrator installs one FTP server on Modules ▸ FTP servers (Pure-FTPd, vsftpd or ProFTPD; a server runs one) and switches it on. That opens port 21 and a passive range of 30000 to 30099 in this server's firewall, armed with the ten-minute rollback: confirm it with Keep this firewall on the Server screen. The same ports have to be allowed in a firewall in front of the machine.

Once it is on, the FTP tab shows the FTPS settings beside the SFTP ones, for the same extra accounts and the same passwords:

  • Encryption: Require explicit FTP over TLS, port 21. Plain FTP is refused, and so is the hosting account's own login.
  • The server presents a certificate it made for itself, so the client asks once whether to trust it.
  • With Pure-FTPd a session opens in the account's starting folder, as over SFTP. vsftpd and ProFTPD begin every session at the top of the hosting account's home instead, and the tab says so when one of them is the server.
The connection settings for an extra account: over SFTP host example.com, port 2222, username u1s1 and the sftp command; over FTPS host example.com, port 21, the same username.
What to type into a client for an extra account, over SFTP and over FTPS, on the test machine with Pure-FTPd switched on.

Switching SFTP off

SFTP is part of the panel, with nothing to install. The SFTP card on Modules can switch it off for the whole server; that closes port 2222 and stops the customers' SFTP service, and does not touch the SSH the server itself is administered over.