Setup SFTP Server Ubuntu - Secure SSH File Transfer

Install the OpenSSH Server Package

SFTP is file transfer that rides inside SSH, so every password and every file is encrypted end to end. On Ubuntu it is not a separate product you hunt for — it is a small part of the OpenSSH server. Ubuntu ships with an SSH client, but the server side is a separate package. Install it:

sudo apt update
sudo apt install openssh-server

Run sudo apt update first so the package list is fresh, then install and confirm with Y. The installer creates the config at /etc/ssh/sshd_config and generates this machine's host keys automatically. That is genuinely all the software there is — SFTP is a subsystem of this one service, not an extra download, and it answers on the standard SSH port 22.

Start the Service and Make It Survive Reboots

The package usually starts the service by itself. Prove it, and make sure it comes back after a power cut:

sudo systemctl status ssh
sudo systemctl enable ssh
sudo systemctl start ssh

sudo systemctl status ssh should show the green active (running) line — that means the SFTP server is already listening. sudo systemctl enable ssh makes it start at every boot, and if it ever stops, sudo systemctl start ssh brings it back. After any config change later, sudo systemctl restart ssh is the command that applies it.

Confirm the SFTP Subsystem Line

Open the config once and simply look at it:

sudo nano /etc/ssh/sshd_config

Near the bottom you should find this line, which Ubuntu includes by default:

Subsystem sftp /usr/lib/openssh/sftp-server

If the line is missing, add it exactly as shown — without it, SSH logins work but file transfers are refused. Leave everything else alone for now; hardening changes to this file are made one setting at a time, on purpose.

Create a Dedicated Transfer User

Never hand out your own admin login for file transfers. Make an account that exists only for moving files:

sudo adduser sftpuser

Set its password when asked, and skip the name and phone questions with Enter — they are optional. This user gets a home folder at /home/sftpuser and nothing else.

Open the Firewall

If UFW is active on the server, port 22 needs an explicit pass before any client can reach the service:

sudo ufw allow OpenSSH
sudo ufw status

The OpenSSH profile opens exactly port 22 — the single port that carries both the SSH login and the SFTP transfer. Confirm the rule is listed in the status output before you test from another machine.

Connect and Transfer the First File

From a second machine on the same network, connect with the transfer user. Replace the address with your server's real IP — run ip a on the server to see it:

sftp [email protected]

Inside the session, put uploads a file, get downloads one, and exit leaves. On Windows, WinSCP and FileZilla both speak SFTP and connect with just the address, port 22, username and password.

Your server is now working. A quick install gives you a working server, not a finished one — password login on the open internet, users who can see the whole disk, and no login records are the three gaps to close next, one by one.