View Categories

Require SSH Public-Key Authentication for All Users (SFTP)

Hosted~FTP~ version 65 introduces an account-level option to require SSH public-key authentication for SFTP users. When this option is enabled, a password by itself is not sufficient to authenticate an SFTP connection.

This setting is useful for organizations that want to enforce key-based SFTP access for employees, partners, automated jobs, and service integrations.

Before you enable the requirement #

Confirm that every person and integration that connects through SFTP has:

  • An SSH key pair.
  • The public key added to the correct HostedFTP user profile.
  • The matching private key configured in the SFTP client, script, or integration.
  • Successfully completed a test SFTP login using the key.

Enabling the requirement before all users and integrations are ready can interrupt SFTP access. Pay particular attention to unattended jobs, scheduled transfers, and third-party integrations, since they may still be configured for password authentication.

Enable public-key authentication for all SFTP users #

  1. Sign in to HostedFTP as an account administrator.
  2. Open Setup.
  3. Locate Require SSH public-key authentication for all users (sftp) in the account-level options.
  4. Select Customize.
  5. Select Require SSH public-key authentication for all users (sftp) in the customization section.
  6. To enforce the requirement without group or user exceptions, clear Allow overrides in group/user setup.
  7. Save the changes.
  8. Test an SFTP connection with a user that has a configured public key.
  9. Confirm that a password-only SFTP connection is rejected.

If Customize is not available, the setting is controlled at the HostedFTP service level and cannot be changed in account setup.

The requirement applies when an SFTP user authenticates. Existing user passwords are not deleted or reset.

What changes after the setting is enabled #

Sign-in methodSFTP result
A valid private key that matches the user’s configured public keyAuthentication can continue
Password onlyAuthentication is rejected
A key that does not match the user’s configured public keyAuthentication is rejected
No public key configured for the userAuthentication is rejected

The setting applies to SFTP authentication. It does not, by itself, change authentication for the HostedFTP web interface, FTP, or FTPS. Those access methods continue to follow their own enabled protocols and security policies.

Public-key support compared with public-key enforcement #

Adding a public key to a user allows that user to authenticate with the matching private key. It does not necessarily prevent the user from authenticating to SFTP with a password.

The Require SSH public-key authentication for all users (sftp) option is the enforcement policy. When the effective policy requires a public key, password-only SFTP authentication is not permitted.

The policy follows the HostedFTP configuration hierarchy:

  1. The service-level value is the default for accounts.
  2. An account can customize the value only when account overrides are allowed at the service level.
  3. A group can customize the account value only when overrides below the account are allowed.
  4. A user can customize the inherited account or group value only when overrides at that level are allowed.

The inherited value appears beside a disabled checkbox. Selecting Customize reveals the value that will override it. Allow overrides in group/user setup controls whether lower levels can create exceptions.

To enforce public-key authentication for every SFTP user in the account, select the account-level requirement and do not allow lower-level overrides.

Configure a user for key-based SFTP access #

  1. Generate an SSH key pair in the user’s SFTP client or key-management tool.
  2. Keep the private key secure. Do not upload or send it to HostedFTP.
  3. Add the public key to the intended HostedFTP user profile.
  4. Configure the SFTP client or integration to use the matching private key.
  5. Test the connection before key-only authentication becomes mandatory.

Each key must be assigned to the correct HostedFTP user. A valid key for one user does not authenticate another user.

Troubleshooting #

If a user cannot connect after the requirement is enabled, check the following:

  • The connection uses SFTP, not FTP or FTPS.
  • The SFTP client is presenting the intended private key.
  • The matching public key is saved on the correct HostedFTP user.
  • The username in the client matches that HostedFTP user.
  • The public key was copied completely and was not altered by line wrapping or extra characters.
  • An automated integration is not silently falling back to password authentication.
  • The client is not selecting a different key from an SSH agent or local key store.

Client messages such as Permission denied, Authentication failed, or No supported authentication methods available can indicate that the server did not accept the presented key. Review the client configuration and the public key stored for the user.

When a password-only SFTP login is rejected by this policy, HostedFTP records login status 353: Failed login - sftp public key authentication required for user.

Roll back the account-wide requirement #

If users need temporary password-based SFTP access while their keys are being corrected:

  1. Return to Setup and locate the account-level SFTP public-key requirement.
  2. Select Customize, if account customization is allowed.
  3. Clear Require SSH public-key authentication for all users (sftp).
  4. Choose whether group and user overrides should remain allowed.
  5. Save the changes.
  6. Retest the affected user.

Clearing Customize does not explicitly disable the requirement. It restores the inherited service-level value, which may still require public-key authentication. Password-based SFTP access is restored only when the user’s effective service, account, group, and user configuration allows it.

Scroll to Top