Transfer Files to a Linux VPS with FileZilla (SFTP)

SFTP runs inside your existing SSH connection, so it needs no extra server software and no extra port. On a VPS Linux Infrawire it is the safest way to upload a website or fetch backups with a graphical client such as FileZilla. This guide covers password and key login, file permissions, and a restricted SFTP-only user.

📋 Prerequisites

A Linux VPS (Ubuntu 24.04, Debian 12, AlmaLinux 9 or Rocky 9) with SSH working on port 22.
The VPS IP and root password, available in your customer area.
FileZilla Client installed on your computer (use the Client, not FileZilla Server).

1. Connect quickly with a password

For a first test, use the Quickconnect bar at the top of FileZilla:

Host: sftp://VPS_IP
Username: USER
Password: your password
Port: 22

Accept the host key the first time. The remote panel on the right shows the server file tree. Prefer a regular user over root: it limits the damage of a wrong click.

Bash
1adduser USER
2usermod -aG sudo USER

On AlmaLinux or Rocky use useradd -m USER, passwd USER and usermod -aG wheel USER.

2. Log in with an SSH key

Keys are safer than passwords and cannot be brute-forced. On your own computer, generate a key pair and copy the public part to the server.

Bash
1ssh-keygen -t ed25519 -C "filezilla"
2ssh-copy-id USER@VPS_IP

In FileZilla open Edit > Settings > Connection > SFTP > Add key file and pick your private key (the file without .pub). FileZilla may offer to convert it to its own format; accept. Never share the private key.

3. Save the connection in the Site Manager

Open File > Site Manager and click New site.
Protocol: SFTP - SSH File Transfer Protocol.
Host: VPS_IP, Port: 22.
Logon Type: Normal for a password, or Key file for a key.
User: USER. Under the Advanced tab set the default remote directory, for example /var/www/example.com.
Click Connect. The site is stored for next time.

Avoid the logon type "Ask for password" on shared computers, and do not save passwords on a machine you do not control.

4. Set ownership and permissions for web files

Uploaded files often end up owned by the wrong user, which causes 403 or 500 errors. Give the web directory to your user and let the web server read it.

Bash
1mkdir -p /var/www/example.com
2chown -R USER:www-data /var/www/example.com
3find /var/www/example.com -type d -exec chmod 755 {} \;
4find /var/www/example.com -type f -exec chmod 644 {} \;

On AlmaLinux and Rocky the web server group is apache instead of www-data. Folders that the application must write to (uploads, cache) can be set to 775 with the group owner being the web server group. Never use chmod -R 777. In FileZilla you can also right-click a file and choose File permissions.

5. Optional: an SFTP-only user locked in a folder

To give a client access to one folder without a shell, use a chroot. The chroot directory itself must belong to root and not be writable by anyone else, otherwise sshd refuses the login.

Bash
1groupadd sftpusers
2useradd -M -d /files -s /usr/sbin/nologin -G sftpusers CLIENT
3passwd CLIENT
4mkdir -p /var/sftp/CLIENT/files
5chown root:root /var/sftp/CLIENT
6chmod 755 /var/sftp/CLIENT
7chown CLIENT:CLIENT /var/sftp/CLIENT/files

Add this block at the end of /etc/ssh/sshd_config:

INI
1Match Group sftpusers
2    ChrootDirectory /var/sftp/%u
3    ForceCommand internal-sftp
4    AllowTcpForwarding no
5    X11Forwarding no

Test the syntax before reloading, and keep your current SSH session open until you confirm a new login works.

Bash
1sshd -t
2systemctl reload ssh

The service is called ssh on Ubuntu and Debian, and sshd on AlmaLinux and Rocky. The restricted user lands in /files and cannot see anything else.

Verification

Test from a terminal before blaming FileZilla:

Bash
1sftp USER@VPS_IP
2sftp> pwd
3sftp> put test.txt
4sftp> ls -l

Then upload a file with FileZilla and check its owner with ls -l /var/www/example.com.

Troubleshooting

Connection refused or timeout: check that sshd is running (systemctl status ssh), that the port is open in the firewall, and that you chose SFTP, not FTP.
Permission denied (publickey): the key is not in ~/.ssh/authorized_keys, or the permissions are wrong. Fix with chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys.
Chrooted user disconnected right after login: the chroot folder is not owned by root or is group-writable. Check the output of journalctl -u ssh for "bad ownership or modes for chroot directory".
Cannot upload, permission denied on a folder: the user does not own the target. Re-run the chown and chmod commands from step 4.

✅ You can now move files safely to your Linux VPS with FileZilla.