Managing SFTP Accounts

SFTP Accounts#

SFTP (SSH File Transfer Protocol) provides a secure, encrypted method for transferring files between your local computer and the server. Unlike regular FTP, SFTP encrypts both credentials and data, making it the recommended choice for file transfers in production environments.

HostsNix lets you create isolated SFTP accounts per website, giving you fine-grained control over who can access what.

Creating an SFTP Account#

1. Navigate to SFTP Accounts from the sidebar
2. Click “Create SFTP Account”
3. Fill in the details:
   • Username — Choose a descriptive username (e.g., developer_john or client_upload)
   • Password — Set a strong password with at least 12 characters including mixed case, numbers, and special characters
   • Website / Home Directory — Select which website’s directory this account can access. The user will be jailed (chrooted) to this directory
4. Click “Create”

???? What is chroot jailing? When an SFTP account is chrooted, the user is restricted to their assigned directory. They cannot navigate above it or access other websites’ files on the server. This is a critical security feature for multi-site servers.

Connecting via SFTP#

Use these connection details in your SFTP client (FileZilla, WinSCP, Cyberduck, Transmit, or any other SFTP-capable client):

• Protocol: SFTP (SSH File Transfer Protocol) — not regular FTP
• Host: Your server’s IP address or hostname
• Port: 22
• Authentication: Password
• Username: The SFTP username you created
• Password: The password you set during creation

FileZilla Quick Connect Example:

1. Open FileZilla
2. In the Quickconnect bar at the top, enter:
   • Host: sftp://your-server-ip
   • Username: Your SFTP username
   • Password: Your SFTP password
   • Port: 22
3. Click “Quickconnect”
4. You’ll see the website’s files on the right side panel

Managing Existing Accounts#

The SFTP accounts list shows all created accounts with their username, linked website, and status. Available actions:

• Change Password — Update the account password. The connected user will need to reconnect with the new password
• Enable/Disable — Temporarily suspend an account without deleting it. Disabled accounts cannot connect
• Delete — Permanently remove the SFTP account. This only removes the account — website files are not affected

Use Cases#

• Developer access — Give developers SFTP access to deploy code without sharing SSH credentials
• Client uploads — Let clients upload media files directly to their website’s upload directory
• Automated deployments — Use SFTP in CI/CD pipelines for deploying application updates
• Content team access — Allow content editors to manage static files and assets