SFTP vs FTP

SFTP (SSH File Transfer Protocol) is NOT FTP-over-SSH. It's a different protocol that runs INSIDE an SSH connection.

Architecture:

Client                       Server
   |                            |
   | SSH connection (port 22)  |
   |<-------------------------->|
   |                            |
   | Channel: subsystem=sftp    |
   | SFTP protocol messages     |

SFTP messages:

• INIT, VERSION (handshake).
• OPEN, CLOSE, READ, WRITE (file operations).
• OPENDIR, READDIR, CLOSEDIR (directory operations).
• REMOVE, RENAME, MKDIR, RMDIR.
• STAT, LSTAT, FSTAT (file metadata).
• READLINK, SYMLINK.
• REALPATH (resolve absolute path).

Each message is binary, length-prefixed:

[length (4 bytes)] [type (1 byte)] [request_id (4 bytes)] [payload]

Pros:

• Single port (22).
• Strong auth (SSH keys).
• Simple firewall config.
• Standardized + ubiquitous (OpenSSH).
• Atomic operations (resumable, append-safe).

Cons:

• Heavier per-message than FTP (binary structure).
• Less throughput on high-bandwidth links (SSH adds latency).

When to use SFTP:

• New deployments.
• Internal file transfers.
• Compliance requirements (encrypted transit).

When to use FTP/FTPS:

• Legacy clients (some industrial systems still use).
• Some hosting providers.
• Otherwise: don't.

Tools:

• OpenSSH sftp client (server: sshd with sftp subsystem).
• WinSCP, FileZilla support SFTP.
• Programmatic: paramiko (Python), JSch (Java), libssh.

Other modern alternatives:

• rsync over SSH: efficient incremental sync.
• HTTPS upload: simple PUT/POST.
• S3 pre-signed URLs: time-limited upload links.
• Aspera (commercial): UDP-based, fast, expensive.