How do I back up to an SFTP server?

What you need

An SSH/SFTP server you control, a login that can create and delete files under the remote path, and either a password or a private key.

Add the destination

1. Open Destinations and choose + Add destination, then SFTP.
2. Fill in:
   • Display name (required).
   • Hostname / IP and Port (22).
   • Username.
   • Password, or leave it blank for key authentication and paste the Private key. Add the Key passphrase only if the key is encrypted.
   • Remote path, for example /backups. An absolute path is kept absolute; a relative path is relative to the SSH home.
   • Trusted host keys (optional): leave empty to trust the key the server shows the first time.
3. Choose Add destination, then Test.

Private keys can be Ed25519, ECDSA or RSA (with a passphrase if the key has one).

Host key pinning

If you leave Trusted host keys (optional) empty, BackupWall trusts the key the server shows the first time and pins it. After that, a different key is refused and the connection stops before login, so backups fail until an administrator re-pins it. Check the first key against the server. To re-pin, open the destination's card, edit the trusted host keys and save. A Test that finds another key says so.

How data is stored

SFTP stores the same content-addressed objects as the other remote destinations, grouped into packs of about 32 MB. The files on the SFTP server are not human-readable and you cannot browse your accounts there. To read them without BackupWall, use bw-extract --sftp user@host --sftp-path /remote/path --ssh-key ~/.ssh/id_ed25519. See Get your files out without BackupWall.

Limits to know

• At most 4 SSH logins run at once. A server that allows fewer simultaneous connections may reset them; if Test or backups report connection resets, raise the server's limit on simultaneous SSH connections or logins.
• A dropped connection no longer produces a short listing that looks complete.
• SFTP is tested by PortWall.