How to Use SFTP from the Command Line on Linux

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.

Use OpenSSH’s sftp command to move files between a Linux machine and an SFTP server through an encrypted SSH connection. Connect with sftp user@host, check the remote and local working directories, then use get to download or put to upload. The same client supports custom ports, SSH identity files, recursive directory transfers, remote file management and repeatable batch jobs.

This guide covers the complete command-line workflow, including key-based authentication, FIDO2-backed keys, automation, failure handling and the checks that resolve most connection and permission errors.

What you need before starting

SFTP is a subsystem of SSH. The sftp program encrypts the connection with SSH rather than using the unencrypted FTP protocol. You therefore need the same basic information required for an SSH login:

• The server hostname or IP address.
• A username that is allowed to use SFTP.
• The SSH port, normally 22 unless the server administrator specifies another one.
• The remote directory you should use, if it is not the account’s default directory.
• An authentication method accepted by the server: a password, an SSH private key, or another configured method.
• A local directory where downloaded files can be written and from which uploads can be read.

The server must expose an SFTP subsystem, and its account permissions must allow the operation you intend to perform. A server can accept SSH connections while denying SFTP, writing, directory creation or access to a particular path.

Check the manual installed on your Linux distribution with man sftp. Options and extensions can differ between OpenSSH releases, especially on older distributions.

Connect to an SFTP server

Run these commands from a Linux shell. In each case, replace the example account and hostname with the values supplied by your administrator.

Command	Use
sftp alice@example.com	Connect on the default SSH port.
sftp -P 2222 alice@example.com	Connect on port 2222. The port option is uppercase -P.
sftp -i ~/.ssh/id_ed25519 alice@example.com	Select a particular SSH private-key file.
sftp alice@example.com:/var/tmp	Connect and request /var/tmp as the initial remote directory.
sftp sftp://alice@example.com/var/tmp	Use an SFTP URI with a starting remote path.

After the connection starts, SSH may ask you to confirm the server host key. Confirm it only when the fingerprint matches a value obtained through a trusted channel. You will then authenticate using the method configured for the account. A successful session displays the sftp> prompt.

$ sftp alice@example.com
The authenticity of host ... cannot be established.
...
sftp>

If the server uses a non-default port and a key, combine the options: sftp -P 2222 -i ~/.ssh/id_ed25519 alice@example.com. Keep the private key on the local machine; the server receives the corresponding public key or uses another authentication service.

Understand local and remote locations

SFTP maintains two working directories: one on the server and one on your Linux computer. The commands look similar, so check both before every transfer.

Command	Directory it examines or changes
pwd	Print the current remote directory.
ls	List files in the current remote directory.
cd path	Change the remote directory.
lpwd	Print the current local directory.
lls	List files in the current local directory.
lcd path	Change the local directory.

A safe inspection sequence is:

sftp> pwd
sftp> lpwd
sftp> ls -la
sftp> lls -la
sftp> cd incoming
sftp> lcd ~/Downloads

Here, ls -la runs on the server, while lls -la runs locally. The distinction prevents a file from being uploaded from the wrong build directory or downloaded into an unexpected location.

Download files with get

Download into the current local directory

Use get when the source is remote and the destination is local:

sftp> get report.csv

The client writes report.csv in the local directory shown by lpwd.

Choose a different local filename or path

sftp> get /remote/path/report.csv ./report.csv

The first argument is the remote source; the second is the local destination. Set the local directory with lcd first when several files share the same destination.

Download a directory

Use the recursive form supported by your installed client:

sftp> get -r remote_dir

On older OpenSSH builds, confirm the syntax with help get or man sftp. Recursive downloads reproduce a directory tree locally and can transfer considerably more data than a single-file command, so verify pwd, lpwd and the directory name before starting.

Upload files with put

Upload using the original filename

Use put for a local-to-remote transfer:

sftp> put ./build.tar.gz

The file is written in the current remote directory displayed by pwd.

Choose a remote destination

sftp> put ./build.tar.gz /incoming/build.tar.gz

This form makes the remote destination explicit. Confirm that the account can write to /incoming and that an existing file will not be overwritten unintentionally.

Upload a directory recursively

sftp> put -r local_dir

Check the installed manual if -r is rejected or behaves differently on an older release. Before a recursive upload, use lls to inspect the local tree and ls to verify the remote parent directory.

Manage files and directories in the remote session

The interactive client also provides common remote filesystem operations:

sftp> mkdir incoming
sftp> rename old.txt archive/old.txt
sftp> rm failed-upload.tmp
sftp> df -h
sftp> bye

• mkdir creates a remote directory when the account has permission.
• rename moves or renames a remote file. The destination directory must exist and be writable.
• rm permanently removes a remote file. Treat it as destructive; there is no general recycle bin.
• df -h requests remote filesystem statistics. The server must support the relevant operation.
• bye, exit or quit ends the session.

The manual also documents remote chmod, chown, chgrp, link operations and additional filesystem-statistics commands. Availability depends on the server and the permissions granted to your account. Ownership changes are commonly restricted to privileged users.

Choose an authentication method

Method	Best fit	Important limitation or requirement
Password	Occasional interactive transfers	Requires a person to answer the prompt; it cannot service an unattended batch job.
SSH public key	Routine administration and automation	The server must have the public key authorized for the account, and the client must be able to read the matching private key.
FIDO2-backed SSH key	Interactive access where a hardware-backed credential is required	OpenSSH 8.2 or newer and a build with FIDO support are required for FIDO2 key types.

Use an SSH private key

Specify the identity file with -i:

sftp -i ~/.ssh/id_ed25519 alice@example.com

If the key is protected by a passphrase, SSH may ask for that passphrase during an interactive login. Ensure the path is correct and that the private key is protected from other local users. The server-side authorized public key, account name and port must all match the connection you are making.

Use a FIDO2-backed key

OpenSSH supports security-key types such as ed25519-sk and ecdsa-sk. Yubico’s SSH guidance specifies OpenSSH 8.2 or newer for FIDO2 hardware-backed keys and notes that the OpenSSH build must include FIDO support, such as support provided through libfido2. It also lists OpenSSH 8.3 or newer for resident-key download and 8.4 or newer for the verify-required option. These are client and build prerequisites, not requirements for ordinary password or software-key authentication. Check the installed ssh and sftp versions before choosing a security-key workflow.

Automate transfers with batch mode

Batch mode reads SFTP commands from a file or standard input instead of waiting for you to type at the sftp> prompt. Create a file named upload.sftp:

lcd ./dist
cd /incoming
put app.tar.gz
put checksums.txt
bye

Run it with:

sftp -b upload.sftp deploy@example.com

The commands execute in order. lcd changes the local source directory, cd selects the remote destination, and each put uploads one file. Use an explicit remote path in the batch file when a job must not depend on the account’s default directory.

Make authentication non-interactive

Batch mode has no interactive password prompt. Configure public-key authentication or another non-interactive method before scheduling the job. Test the same account and key interactively first, then run the batch command with the exact environment used by the scheduler.

Handle failures deliberately

The client can stop when a transfer or filesystem command fails. The SFTP manual documents a per-command prefix that suppresses termination for that command when continuing is intentional. For example:

-put optional-report.csv

Use that prefix only for an operation whose failure is acceptable. For required uploads, allow the failure to stop the batch and make the calling script record the nonzero process status. Capture standard output and error in the scheduler’s logs so an operator can identify the failed command.

Test before scheduling

1. Run the commands interactively and verify the remote filenames and directory.
2. Copy the exact commands into the batch file, including lcd and cd paths.
3. Run sftp -b upload.sftp deploy@example.com manually with the intended key and port.
4. Confirm the uploaded files and inspect the command’s exit status.
5. Only then place the job in a scheduler, retaining logs and protecting the batch file from unauthorized edits.

Interactive, batch and recursive workflows compared

Decision	Choose this when	Checks to make
Interactive session	You are exploring directories, transferring a few files or responding to an incident.	Inspect both working directories and confirm each destination before put or get.
Batch file	The same transfer must run repeatedly or without a person present.	Use non-interactive authentication, explicit paths, exit-status handling and logs.
Single-file transfer	You need one known file and want the smallest possible change.	Check the source and destination names to avoid overwriting another file.
Recursive transfer	An entire directory tree must move.	Confirm recursive syntax in the local manual and estimate the scope before starting.
Default SSH port	The server listens on port 22.	Use the plain command and verify the hostname.
Custom SSH port	The administrator assigned another port.	Pass the uppercase -P option; do not confuse it with the lowercase SSH options used by other commands.

Plan a reliable transfer

For a one-off job, first identify the exact source and destination, then inspect both sides before changing anything. A repeatable sequence is to connect, run pwd and lpwd, list the relevant directories, change locations explicitly with cd and lcd, and transfer one test file. Confirm its name and size on the destination before moving a whole directory.

Do not assume that a successful login means every operation will work. Read access, write access, directory traversal and directory creation are separate permissions. An account may be able to list a directory but be unable to upload there, or it may be confined to a particular tree. Ask the administrator which path is writable and whether existing names are replaced. Use a temporary filename or a staging directory when the receiving application must not see a partially uploaded file, then rename it only after the transfer completes if the server permits that operation.

For automation, keep the batch file and its key under an account that the scheduler can read but other users cannot modify. Use absolute paths where possible, because a scheduler may start in a different local directory than your interactive shell. Log the command output and exit status, and arrange an alert for required-file failures. Never put a private-key passphrase, password or other secret directly in the batch file.

Common command-line questions

Can I use SFTP without installing another program? On most Linux distributions, OpenSSH’s sftp client is packaged with the standard SSH tools. Check with command -v sftp; if it is absent, install the distribution’s OpenSSH client package through its normal package manager.

Is SFTP the same as FTP? No. SFTP is an SSH file-transfer subsystem and inherits SSH encryption and authentication. It does not use the FTP protocol or FTP’s separate control and data connections.

How do I upload or download several named files? Run one put or get command per file, or place those commands in a batch file. Use lls and ls to verify the local and remote names first. For a directory tree, use the recursive form supported by the installed client.

Why does sftp -p not select a port? The port option is uppercase -P. Always check man sftp on the installed release rather than assuming options match another SSH-related command.

Can a FIDO2 security key run an unattended transfer? FIDO2 keys are designed for hardware-backed authentication and commonly require user presence or verification. They are therefore generally suited to interactive access, while scheduled jobs normally use a protected software SSH key or another non-interactive method approved by the server administrator.

Does SFTP provide transfer-speed or cost guarantees? The OpenSSH manual defines the protocol client and its commands, not a performance target or service price. Throughput depends on the network, server, disk and encryption workload, while account or hosting charges come from the service provider. Test the actual path and review the provider’s current terms for any commercial service.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Troubleshoot a failed SFTP connection or transfer

The connection is refused or times out

• Check the hostname and username for spelling errors.
• Confirm the port. Retry with the administrator’s value, for example sftp -P 2222 user@host.
• Ask the server administrator whether the SSH service and SFTP subsystem are enabled and whether your source network is allowed.

Authentication fails

• Run sftp -vvv user@host to display SSH negotiation and authentication diagnostics.
• For a key, verify the -i path, the key’s local protection, the account name and the public key installed on the server.
• For a FIDO2 key, verify that the OpenSSH version is at least 8.2 and that the build includes FIDO support.
• Make sure the account is using the expected authentication method; a server may disable passwords or restrict particular key types.

The login works but a path or transfer fails

• Run pwd and ls -la to confirm the remote path, then run lpwd and lls -la to confirm the local side.
• Check that the server account can read the source, write the destination, create directories or delete files as required.
• Confirm that the remote SFTP subsystem supports the command. Some filesystem-statistics, ownership and link operations depend on server capabilities.
• For recursive operations, verify the spelling and use help get, help put or man sftp if the installed release reports an option error.

A batch job stops unexpectedly

• Remove commands that require an interactive answer, especially password authentication.
• Run the batch file manually with the same key, port, username and working directories.
• Review logs for the first failed command; later commands may not have run.
• Use the documented per-command prefix only when a particular failure should not terminate the batch.
• Check the process exit status in the surrounding script or scheduler and alert on required-transfer failures.

Operational and security practices

• Verify a new host key through a trusted administrator or published fingerprint before accepting it.
• Use the least-privileged SFTP account and a directory that contains only the files the job needs.
• Protect private keys and do not place passphrases or secrets in a batch file.
• Use explicit remote and local paths in automation instead of relying on an unknown starting directory.
• Treat rm, ownership changes and recursive transfers as high-impact operations; test with a non-destructive listing first.
• Keep the local sftp manual available because distribution versions expose different options and extensions.

Quick reference

# Connect
sftp user@host
sftp -P 2222 user@host
sftp -i ~/.ssh/id_ed25519 user@host

# Inspect and change locations
sftp> pwd
sftp> lpwd
sftp> ls -la
sftp> lls -la
sftp> cd incoming
sftp> lcd ~/Downloads

# Transfer
sftp> get remote-file
sftp> get /remote/path/report.csv ./report.csv
sftp> put ./build.tar.gz
sftp> put ./build.tar.gz /incoming/build.tar.gz
sftp> get -r remote_dir
sftp> put -r local_dir

# Finish
sftp> bye

For a one-off transfer, connect interactively and verify both working directories before using get or put. For repeatable work, move the tested commands into a batch file, use non-interactive authentication and monitor the process result.

Frequently Asked Questions

How do I connect to SFTP from a Linux terminal?

Run sftp user@host. Add uppercase -P for a custom port, -i PATH for a specific private key, or append a remote path to choose the starting directory.

How do I upload a file with SFTP?

At the sftp> prompt, run put ./local-file /remote/path/remote-file. Check lls and pwd first so you use the intended source and destination.

How do I download a file with SFTP?

Run get /remote/path/file ./local-name. The destination is local; confirm it with lpwd and avoid overwriting an existing file unintentionally.

Can I automate SFTP transfers?

Yes. Put commands such as lcd, cd, put and bye in a file, then run sftp -b batchfile user@host. Use public-key or another non-interactive authentication method.

What OpenSSH version supports FIDO2 SSH keys?

Yubico documents OpenSSH 8.2 or newer, with FIDO support in the build, for FIDO2 key types. It lists 8.3 or newer for resident-key download and 8.4 or newer for verify-required.

Why can I log in but not upload?

A successful SSH login does not guarantee SFTP write permission. Check the remote path with pwd and ls -la, confirm the account can write or create files there, and ask the administrator whether the SFTP subsystem restricts the account.

The Bottom Line

OpenSSH SFTP is usually all you need for secure Linux file transfers: connect with the right host, port and identity, verify both working directories, use get or put, and switch to a tested batch file with non-interactive authentication for repeatable jobs. Consult the installed manual whenever an option or server extension differs.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.