SFTP
SSH File Transfer ProtocolSFTP is not FTP with encryption bolted on — it is a different protocol entirely, run as a subsystem inside an ordinary SSH connection. That gives it SSH’s authentication and encryption for free, over a single port that a firewall already understands.
SFTP is a file protocol carried inside SSH — one port, one authentication, encrypted from the first byte.
How it works
Because it is a channel, SFTP multiplexes alongside a shell on the same connection — and because SSH already authenticated, there is no second login and no second port to open.
What SFTP does, step by step
The usual SSH handshake runs: key exchange, host key check, then user authentication by key or password.
The client opens a channel and asks for the sftp subsystem rather than a shell.
Both sides agree a protocol version, then work in binary request/response packets carrying a request id.
Handles are opened, read and written at explicit offsets — which is what makes resume and random access work.
In cybersecurity
SFTP inherits everything SSH gets right — so its risks are mostly about what a legitimate account is allowed to reach once it is in.
There is no unencrypted mode; confidentiality and integrity come from the SSH transport.
Authorised keys work here as for a shell — and are equally easy to leave behind.
Without a restricted directory an SFTP account can read wherever the OS permissions allow.
An account meant only for files should not also grant an interactive login.
The same first-connect fingerprint prompt is what stops a man-in-the-middle — don’t train users past it.
Everything is on 22, which makes the firewall simple and the brute-force target obvious.