Dovetailed Technologies


sftp-server — SFTP server subsystem


sftp-server [-ehR] [-d start_directory] [-f log_facility] [-l log_level] [-u umask]


When using Co:Z SFTP, this command is not invoked directly, it is invoked using the shell script

sftp-server is a program that speaks the server side of SFTP protocol to stdout and expects client requests from stdin. sftp-server is not intended to be called directly, but from sshd(8) using the Subsystem option.

Command-line flags to sftp-server should be specified in the Subsystem declaration. See sshd_config(5) for more information.

z/OS specific notes:

  • Features and options that are different from the base sftp-server command are noted below with [z/OS]


-d start_directory

specifies an alternate starting directory for users. The pathname may contain the following tokens that are expanded at runtime: %% is replaced by a literal '%', %d is replaced by the home directory of the user being authenticated, and %u is replaced by the username of that user. The default is to use the user's home directory. This option is useful in conjunction with the sshd_config(5) ChrootDirectory option.

[z/OS] z/OS feature: The SFTP_ZOS_INITIAL_DIR environment variable, if set, will override the start_directory set by this option. See Configuring the Co:Z SFTP Server in the Co:Z SFTP - User's Guide.


Causes sftp-server to print logging information to stderr instead of syslog for debugging.

-f log_facility

Specifies the facility code that is used when logging messages from sftp-server. The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7. The default is AUTH.


Displays sftp-server usage information.

-l log_level

Specifies which messages will be logged by sftp-server. The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. INFO and VERBOSE log transactions that sftp-server performs on behalf of the client. DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of debugging output. The default is ERROR.


Places this instance of sftp-server into a read-only mode. Attempts to open files for writing, as well as other operations that change the state of the filesystem, will be denied.

-u umask

Sets an explicit umask(2) to be applied to newly-created files and directories, instead of the user's default mask.

On some systems, sftp-server must be able to access /dev/log for logging to work, and use of sftp-server in a chroot configuration therefore requires that syslogd(8) establish a logging socket inside the chroot directory.

See Also

sftp(1), ssh(1), sshd_config(5), sshd(8).

T. Ylonen and S. Lehtinen, SSH File Transfer Protocol, draft-ietf-secsh-filexfer-02.txt, October 2001, work in progress material.

Copyright© 2009-2017 Dovetailed Technologies, LLC. All rights reserved.
Co:Z® is a registered trademark of Dovetailed Technologies, LLC.