Question SFTP access for additional FTP accounts – Public Key authentication?

[TorbHo]

Server operating system version

Ubuntu 24

Plesk version and microupdate number

Plesk 18.0.80 Update 3

We are currently using Plesk 18.0.80 Update 3.

According to the changelog, this version introduces the following feature:

SFTP access for additional FTP accounts via a separate ProFTPD

We are trying this new feature, and SFTP access for additional FTP accounts works correctly when using password authentication.

However, we have not been able to authenticate using an SSH public key. Public key authentication works for our regular SSH accounts, but not for the additional FTP accounts using the new SFTP feature.

• We added the public key using the Plesk extension "SSH Keys Manager".
• We have added our public key using the Plesk extension "SSH Keys Manager".
• Public key authentication itself is working correctly when connecting via the standard SSH/SFTP port 22. However, it does not work when connecting through the new SFTP port configured under:
  Tools & Settings → Security Policy

The configured port is open in the firewall and the SFTP connection itself can be established successfully. However, when connecting through this port, the server always asks for the account password instead of authenticating with the public key.

Does the new SFTP functionality for additional FTP accounts support public key authentication, or is it currently limited to password authentication only?

If public key authentication is supported, is there any additional configuration required in Plesk/ProFTPD to enable it for these accounts?

 

[Sebahat.hadzhi]

Hi, @TorbHo . This is expected behavior. SFTP for additional FTP accounts currently supports password authentication only. These additional FTP accounts are, by definition, FTP accounts. SFTP on separate port handed by ProFTPd doesn't work OpenSSH authorization keys.

If key-based login is needed, it would need to go through the system SSH user (e.g. the subscription's main system user).

 

[TorbHo]

@Sebahat.hadzhi thank you for your response.

That’s very unfortunate, as setting up SSH users with the appropriate system-level access permissions is quite complicated and time-consuming.

I had hoped the new system would offer more in this regard. As it stands, I’m struggling to see the real added value if it essentially works like the regular FTP user account.

Using a username and password for authentication is simply no longer considered a modern or sufficiently secure approach. We are therefore trying to migrate everything to more secure, modern authentication methods, and I had hoped that this new feature would support us in doing exactly that.