SFTP failures on Plesk servers with functional SSH typically stem from misconfigured subsystems, restrictive firewall rules, or permission errors. Verify that the sftp-server subsystem is correctly defined in the OpenSSH configuration and ensure your FTP client uses the SFTP protocol rather than legacy FTP. This article details the diagnostic steps to resolve these connectivity issues.
Distinguishing SSH from SFTP Protocols
It is crucial to understand why a standard SSH connection succeeds while SFTP fails. SSH provides a command-line interface for remote access, whereas SFTP (SSH File Transfer Protocol) is a distinct subsystem within the SSH daemon that handles file transfers. If you can log in via terminal using PuTTY or the command line but cannot connect via FileZilla or PHPStorm, the issue lies not in network connectivity but in how the SFTP service is configured or accessed. Many users confuse FTP with SFTP. Standard FTP uses separate ports for control and data, while SFTP runs entirely over a single encrypted channel, typically port 22. If your client attempts to use traditional FTP over an SSH-enabled server, it will fail because the underlying services are different. Ensure your FTP client is explicitly set to use the "SFTP - SSH File Transfer Protocol" option, not "FTP - File Transfer Protocol". In FileZilla, this is selected in the Protocol dropdown menu at the top of the Quickconnect bar.Verifying the SFTP Subsystem Configuration
The most common cause for this discrepancy is an incorrect or missing definition of the SFTP subsystem in the OpenSSH configuration file. The SSH daemon must know which program to execute when a client requests file transfer capabilities. On most Linux distributions managed by Plesk, this is handled by the/etc/ssh/sshd_config file.
Open a terminal session and edit the configuration file using a text editor such as nano or vi. Look for the line that begins with Subsystem sftp. It should point to the internal SFTP server provided by OpenSSH. The correct line typically looks like this:
Subsystem sftp internal-sftp/usr/libexec/openssh/sftp-server, it may cause conflicts depending on your specific Plesk version and operating system. For modern setups, internal-sftp is generally preferred for better performance and security integration. After making any changes, you must restart the SSH service for the settings to take effect. You can do this by running:
systemctl restart sshdservice sshd restartChecking Firewall and Port Restrictions
Even if the software configuration is correct, network-level restrictions can block SFTP traffic while allowing SSH. While both protocols often share port 22, some security policies treat them differently or restrict specific types of traffic. If you have customized your firewall rules, ensure that inbound traffic on port 22 is allowed for all necessary IP ranges. In Plesk, the built-in firewall tool allows you to manage these rules. Navigate to the Security section in the Plesk dashboard and review the Firewall settings. Ensure that TCP port 22 is open. If you are using a third-party firewall like iptables or firewalld directly on the server, verify that there are no DROP or REJECT rules specifically targeting SFTP packets. Although rare, some intrusion prevention systems might flag SFTP connections as suspicious if they detect unusual file transfer patterns, temporarily blocking the connection. Additionally, if you are using a cloud provider like AWS, Azure, or DigitalOcean, check the security group or firewall settings associated with your instance. These cloud-level firewalls sit outside the OS and must also permit inbound traffic on port 22. A common mistake is configuring the OS firewall correctly but forgetting to update the cloud provider's security group rules.Resolving Permission and User Account Issues
SFTP requires specific permissions to function correctly. If the user account you are trying to connect with lacks read or write permissions in their home directory, the SFTP subsystem may reject the connection or drop it immediately after authentication. Unlike SSH, which might allow login even with limited shell access, SFTP is strictly bound to the filesystem permissions. Ensure that the user has ownership of their home directory and that the permissions are set appropriately. Typically, the home directory should be owned by the user and have permissions set to 755 or 700. You can check this by running:ls -ld /home/usernamechown and chmod commands. Furthermore, if you are using chroot jails for SFTP users, ensure that the root directory of the jail is owned by root and not writable by the user. This is a security requirement for OpenSSH to prevent privilege escalation attacks.
For more advanced configurations involving key-based authentication for passwordless SFTP, refer to our guide on SSH Host RSA Key Configuration for Passwordless SFTP. This can help streamline your workflow and reduce authentication-related errors.
Debugging Client-Side Connections
If the server-side configuration appears correct, the issue may lie with the FTP client itself. Tools like FileZilla and PHPStorm have detailed logging features that can provide insight into where the connection fails. Enable verbose logging in FileZilla by going to Edit > Settings > Connection and setting the Log Level to "Verbose". Try connecting again and examine the log output. Look for specific error messages such as "Connection refused," "Authentication failed," or "Subsystem request failed." These messages can pinpoint whether the problem is network-related, authentication-based, or configuration-driven. If you see errors related to key formats or BOM marks, consult our article on How to Remove BOM Mark in SFTP Username when Using OpenSSH to resolve encoding issues that may interfere with authentication. Sometimes, switching between active and passive modes in your FTP client can resolve intermittent connection drops. While SFTP does not use the same port negotiation as FTP, some clients still apply similar logic to data channels. Experimenting with these settings can sometimes bypass minor compatibility issues between the client and the server's SSH implementation.Frequently Asked Questions
Why does my SSH connection work but SFTP times out?
This usually indicates a firewall rule blocking the SFTP subsystem specifically or a misconfiguration in the sshd_config file. Check that the Subsystem sftp line is present and uncommented, and ensure your firewall allows traffic on port 22 for all protocols, not just generic SSH.
Can I use regular FTP instead of SFTP on a Plesk server?
Yes, but it is less secure. Plesk supports ProFTPD and Pure-FTPd for traditional FTP connections. However, SFTP is recommended because it encrypts both commands and data over a single port. For speed comparisons and setup details, see our guide on Secure Transfer with ProFTPD.
How do I fix "Permission Denied" errors in SFTP?
This error occurs when the user lacks access to their home directory or the chroot jail. Ensure the home directory is owned by the user and has permissions of 755 or 700. If using chroot, the root of the jail must be owned by root and not writable by the user.
Does FileZilla support SFTP with SSH keys?
Yes, FileZilla fully supports SFTP with SSH key authentication. You need to convert your private key to the format expected by FileZilla (typically PEM or OpenSSH format) and load it in the Site Manager under the Encryption and Login Method settings.
What is the difference between SFTP and SCP?
SCP is a simpler protocol for copying files, while SFTP provides an interactive file management system similar to FTP. SFTP allows you to browse directories, rename files, and resume transfers, whereas SCP is primarily for one-time uploads or downloads. For operations like renaming files with wildcards, SFTP is the superior choice.