Skip to content
Skip to main content
SSHepherd Documentation
< All Topics
Print

Protecting an SFTP Server

Applies to SSHepherd 2.0

Overview

Many organizations use the SSH File Transfer Protocol (SFTP) to move and manage files. These steps protect an SFTP server with SSHepherd®, so you can close its listening port to the network and allow only authorized users.

Before you start

  • The SSHepherd® Agent is installed on the SFTP server.
  • The Control App or shepctl is installed on the user’s computer.
  • The user and the SFTP server are in the same SSHepherd® group, or the user has a Generic tunnel definition for it.

Configure the agent for SFTP

Allow the SFTP port on the agent. SFTP normally uses port 22.

  1. In the Administrator Console, click Agents and select the SFTP server.
  2. Click the Settings tab.
  3. Add 22 to Allowed Ports.
  4. Click Save.
Agent Settings tab with 22 in Allowed Ports

The agent applies the change within seconds; you don’t need to restart it.

In SSHepherd 1.x, you ran shepagent --port 22 add-whitelist on the host. That command doesn’t exist in 2.0.

Create a tunnel with shepctl

On your computer, sign in with shepctl, then run:

shepctl --hostname <sftp server host name> --relayport 22 tunnel

shepctl opens a tunnel on localhost with a random port, and prints the port.

To choose the local port yourself, add --port:

shepctl --hostname <sftp server host name> --relayport 22 --port 9999 tunnel

Create a tunnel with the Control App

  1. Ask your administrator for a Generic tunnel definition with To Agent set to the SFTP server, Remote Host 127.0.0.1, Remote Port 22, and a Specific local port such as 9999. See Tunnel Definitions.
  2. In the Control App, switch the tunnel on.

Connect your SFTP client

With the tunnel open, connect your SFTP client to 127.0.0.1 on the tunnel’s local port. For example, with the OpenSSH sftp client and local port 9999:

sftp -P 9999 <user>@127.0.0.1

Note the capital -P, which sets the port for sftp.

Tip: For SSH and SCP to the same server, you can also use shepctl ssh-tunnel and shepctl scp-tunnel, which don’t need port 22 in Allowed Ports. See Creating an SSH Session.

In This Article