Bridge SFTP Servers (SSH) to the Modern Cloud

How to connect SFTP to CloudsLinker

SFTP uses server parameters: hostname, username, password (or SSH private key), port (default 22), and optional initial path.

Before you start

Gather the connection details:

• Hostname (e.g. sftp.example.org or an IP address)
• Username — preferably a dedicated service account, not a real human user
• Authentication method: SSH private key (recommended) or password
• Port (default 22; some servers run SFTP on non-standard ports for security through obscurity)
• Initial path (optional — scope the connection to a specific directory)

For SSH key authentication: generate a dedicated key pair (ssh-keygen -t ed25519 -f cloudslinker_key), add the public key to the server’s ~/.ssh/authorized_keys, and paste the private key into CloudsLinker. Keep the key passphrase-protected for defense in depth.

Connection steps

1. In CloudsLinker, click Add Cloud → choose SFTP.
2. Enter a display name (e.g. “Linux VPS — backup”).
3. Enter the hostname and port (default 22).
4. Enter the username.
5. Choose authentication:
   • Password: enter the user’s SSH password.
   • SSH private key (recommended): paste the contents of your private key file (typically ~/.ssh/cloudslinker_key).
6. (Optional) Enter an initial path to scope the connection (e.g. /home/backup/data).
7. Click Confirm — CloudsLinker establishes the SSH session, validates SFTP, and shows the connection ready.

Server-side hardening

For production SFTP-only setups, configure OpenSSH with:

• Subsystem sftp internal-sftp (use the in-process SFTP subsystem, not the external one)
• Match Group sftpusers block with ChrootDirectory, ForceCommand internal-sftp, AllowTCPForwarding no, X11Forwarding no
• Disable password authentication entirely if all users have SSH keys: PasswordAuthentication no
• Add fail2ban or similar to block brute-force attempts on port 22

Revoke access

Two paths to revoke CloudsLinker’s SFTP access:

• Password auth: change the user’s password on the server.
• SSH key auth: remove the CloudsLinker public key from ~/.ssh/authorized_keys on the server.

Either action invalidates CloudsLinker’s connection immediately.

SFTP upload & download limits you should know

SFTP is a protocol, not a service — limits depend entirely on the SFTP server you’re connecting to:

• Default port: 22 (SSH).
• Encryption: AES-128 / AES-256 with HMAC-SHA-2; modern OpenSSH defaults to chacha20-poly1305 and curve25519 key exchange.
• Maximum file size: no protocol-level cap. Practical limit: server filesystem (16 TiB+ per file on ext4/Btrfs).
• Resume interrupted transfers: supported in SFTP version 6 (the current version since SSH-2).
• Authentication: username + password, SSH private key, or both (key + password = strongest).
• Single port: no separate data channel like FTP — friendly to NAT / firewalls.
• Bandwidth: server-side configurable; no protocol-level cap. CPU encryption overhead can bottleneck on older hardware.
• Concurrent connections: server-side configurable (typically 5–50 simultaneous SSH sessions per user).
• Compatible with: OpenSSH (most Linux servers), Bitvise SSH Server, Cerberus FTP Server, JSCAPE MFT, Couchdrop, AWS Transfer Family, Azure Storage SFTP, and any RFC-compliant SFTP server.
• Chroot jails: OpenSSH internal-sftp subsystem locks users to specific directories without shell access.
• No SFTP-specific encryption-at-rest: SFTP encrypts in transit only. For at-rest encryption, use full-disk encryption on the server.

Sources: Wikipedia: SSH File Transfer Protocol, SolarWinds: SSH File Transfer Protocol glossary, Fortra: SSH keys vs passwords for SFTP, ArchWiki: SFTP chroot setup.