News & Info

Daily Updates and Tech Chatter

SFTP Tips & Tricks

Using Keyfiles To Access SFTP Services

You can use the private key .pem files to allow you to connect via SFTP on a server that only allows key access.

The trick is to get the .pem file that Amazon gives you onto the sever that you will be using to connect to the EC2 instance.   When you store the .pem file on the local box, you will need to ensure the security level is set to 500 (r-x——).

Here is an example:

# sftp -o IdentityFile=my-amazon-given-key.pem root@domU-11-22-33-00-CC-11

We often use this trick to talk to our Amazon EC2 instances as they do not allow password based authentication by default.   This is a good security mechanism as only people with an authorized key file can gain access.   It also gives you a quick an easy way to shut down all access keys by disabling a single key file, essentially shutting down access from an entire group should there be a breach.

Create SFTP Logins Using Private Keyfiles

This is an example based on creating 3rd party access to SFTP on an Amazon EC2 instance.  The article is written for system administrators that wish to grant SFTP access to their server using a private key file they distribute to their users.  There can be multiple key files per username/directory.

  1. Logon to the EC2 instance with a privileged (root?) account.
  2. Create a keypair and save it to your PC.
  3. Start puttygen on your PC.
    1. Conversion/Import – load the key file you saved in step 2.
    2. Save as a private key (I like to add the -priv.ppk extension).
    3. Copy the Key data from the top private key info box (Public key for pasting into OpenSSH authorized_keys file:).
  4. Login to the server where you want the SFTP user to retrieve their files from.
  5. Change to the home directory of the user you want to grant SFTP access to.
  6. Create a .ssh directory.
    1. chmod 700 on that directory (rwx——)
    2. chmod 750 on that directory (rwxr-x—) to open access to other people in the same user group.
  7. Create an authorized_keys file within the .ssh directory.
    1. Create a SINGLE LINE that has the fingerprint you copied from puttygen above.
    2. Save the file.
    3. Chmod 600 on that file (rw——-)
      1. Use mode 640 (rw-r—–) to open access to other people in the same user group.

Now that you have the private key file from step 2.2 above, you can use that to login via PuTTY or SFTP from any system.  The only thing you need is local access to that key file.

Using Private Keys with Filezilla and EC2

After completing the creation of the key file & server-side tweaks to accept that key, you can now use desktop clients such as Filezilla to access your FTP content.   This assumes the system administrator of the server you are connecting to has given you a key file and they have installed the handshake privelages in the authorized_keys file on the remote end.

Pageant Method

  • Start by running pageant on your local system.
  • Add key
  • Find the key you generated with puttygen in step 3.2 above.
  • Start filezilla
  • In site manager enter the host name.  This will be the same server you logged into on step 4 above.
  • Servertype should be set to SFTP
  • Logontype Normal
  • User will be the name of the user that was given SFTP access (you created a .ssh/authorized_keys file in their home directory on the server)

Filezilla Specified Key Method

  • Start Filezilla
  • File/Site Manager – New Site
  • Enter the host name.  This will be the same server you logged into on step 4 from  Create SFTP Logins Using Private Keyfiles
  • Servertype should be set to SFTP
  • Logontype Normal
  • User will be the name of the user that was given SFTP access (you created a .ssh/authorized_keys file in their home directory on the server)
  • Click OK (NOT CONNECT)
  • Edit/Settings
    • Connection/SFTP
    • Add keyfile… and select the private keyfile you generated with puttygen above.
Filezilla - Edit Settings

Filezilla – Edit Settings

Filezilla Site Manager

Filezilla Site Manager

Now connect to that site.   Filezilla will read through the keys and find the right key for the user/server pair that you are connecting to.

15 Awesome Comments So Far

Don't be a stranger, join the discussion by leaving your own comment
  1. lostinmyhead
    November 19, 2010 at 11:52 PM #

    I have searched for hours for this solution. Thank you so much!

    I will link this post to others, this should have been far easier to find.

  2. Ido
    November 23, 2010 at 6:15 PM #

    Perfect – just what I needed for EC2 + SFTP. Thanks!

  3. kevin
    December 3, 2010 at 2:20 PM #

    felt kinda retarded for a moment before i found this! thank you!

  4. Steven Stern
    December 12, 2010 at 10:39 AM #

    THANKS! This saved my morning. I had a lot of files to move to my EC2 instance and wasn’t relishing working from the command line.

    • lcleveland
      December 12, 2010 at 10:42 AM #

      I hear ya Steven – been there. :)

  5. Hernan Velasquez
    January 12, 2011 at 3:38 PM #

    Cool thank you..

    The only issue is that if you have serveral sftp sites, any of them will try to use the private key set and the will not connect (only the site that request the key would work).

  6. Logansanoh
    February 26, 2011 at 10:19 AM #

    Being a linux newbie and getting this competed (without step by steps) was tough, but I pulled through, but, I am still getting the same error I was getting before I started:

    Disconnected: No supported authentication methods available

    I have tried pageant and the filezilla key file mode.
    I can log in via ssh but not sftp, this is killing me!

  7. Logansanoh
    February 26, 2011 at 10:29 AM #

    Weird, my CHMODs never saved, but after updating them I get another error message:

    Disconnected: No supported authentication methods available

    Please help. :)

  8. Steve
    May 27, 2011 at 10:30 AM #

    Thanks for this post! I’m able to connect with FileZilla now without a problem.

  9. Matthew Dahlman
    March 21, 2012 at 11:33 AM #

    I searched for how to do this for a long time. I gave up for months until I ran into a link to this post. Thanks.

    If you were to update the post to apply to Mac OS X users it would be helpful. But even without that, it has the crucial information I needed.

  10. Darrin
    April 28, 2012 at 9:58 PM #

    Thanks for posting. Saved an all-night code-a-thon from becoming an all-night connect-a-thon.

Trackbacks/Pingbacks

  1. Setting Up an sftp Site on Amazon Web Services EC2, Creating an Account to Share With a Third Party, and Restricting that Account to Allow Only sftp « Software Projects - July 3, 2011

    [...] from http://cloud.ubuntu.com/ami/, https://help.ubuntu.com/10.04/serverguide/C/ftp-server.html, http://www.cybersprocket.com/2009/tips-tricks/sftp-tips-tricks/ and [...]

  2. PSA great article on how to get filezilla to work with EC2 linux servers « Steve’s Little world - August 20, 2011

    [...] filezilla for all your sftp/scp’ing needs AND you are using EC2 (which uses keys only) then this little “how to” is a life saver. Very very nice. Like this:LikeBe the first to like this post. [...]

  3. FileZilla and EC2 using private keys « Right Outer Join - March 21, 2012

    [...] re-gave-up. But then I randomly came across this post which links to this post. It describes how to use FileZilla to connect to EC2 using private keys. [...]

  4. Accessing Amazon EC2 in Filezilla SFTP | web technical support - April 21, 2012

    [...] would like to access it just by using FileZilla or similar. And I’ve also tried this but I don’t know what I’d miss, because It didn’t work for me. I downloaded a [...]