SFTP — secure file transfer for scripts and the CLI

SFTP is today’s standard for secure file transfer via scripts, the CLI and automated workflows. It runs over the SSH layer — port 22, same encryption. Unlike full SSH shell access (which we don’t offer), SFTP is file transfer only, no shell.

SFTP works — SSH shell doesn’t

An important distinction:

• SFTP = an SSH subsystem that only allows file operations: ✅ available on storageDRIVE
• SSH shell = an interactive command line on the server: ❌ not available (multi-tenant Synology)

You can upload, download, rename and move files — but not execute commands on the server, not launch scripts. That’s deliberate and clean.

Server details

• Server: drive.xaweho.de
• Port: 22 (standard SSH/SFTP)
• Username: your DSM username
• Password: your regular account password — SFTP never asks for a 2FA code, so a strong password is mandatory
• Authentication: password or SSH key (see below)

SSH key instead of password

Our recommendation for scripts and automated workflows: SSH public key instead of a password.

Generating a key (on your machine)

ssh-keygen -t ed25519 -C "storagedrive-mueller"

Save it at the default path (~/.ssh/id_ed25519). Optionally set a passphrase.

Registering the public key — via ticket to us

There is no self-service flow for this in DSM. On the multi-tenant Synology we set up SSH keys on the server side:

1. Send us the public key (~/.ssh/id_ed25519.pub) via ticket — only the .pub file, never the private key
2. We register it for your account and confirm in the ticket

From then on you can log in with the key instead of the password.

Test

sftp -i ~/.ssh/id_ed25519 mueller@drive.xaweho.de

If everything is right: the SFTP prompt appears without a password prompt.

Setup examples

CLI with OpenSSH (Mac, Linux, Windows 10+)

sftp mueller@drive.xaweho.de

Commands:

• ls, cd, pwd — server-side navigation
• lls, lcd, lpwd — local navigation
• put <datei> — upload
• get <datei> — download
• put -r <ordner> — recursive upload
• mkdir, rm, rename
• quit or bye — exit

FileZilla

1. Site Manager → New site
2. Protocol: SFTP — SSH File Transfer Protocol
3. Host: drive.xaweho.de, port: 22
4. Username + password (or key via Logon type: Key file)

Cyberduck

1. Open Connection → SFTP (SSH File Transfer Protocol)
2. Server, port 22, username, password/key

Mountain Duck

Mounts SFTP as a volume — like a WebDAV mount, just with an SFTP backend.

Script examples

Why rsync over SSH doesn’t work here

rsync over SSH has to start an rsync process on the server — that’s remote command execution, and exactly that is blocked in the multi-tenant setup (SSH shell disabled). The rsync commands from typical tutorials go nowhere on storageDRIVE.

The alternative for sync-style backups: lftp with mirror over SFTP.

Backup with lftp mirror over SFTP

lftp -u mueller,"$SFTP_PASSWORD" sftp://drive.xaweho.de <<EOF
mirror -R --only-newer /local/data /home/mueller/Backup
quit
EOF

mirror -R uploads recursively, --only-newer only transfers changed files. No delta encoding like rsync, but perfectly usable for daily backups.

Daily backup cron:

0 3 * * * /usr/local/bin/backup-storagedrive.sh > /var/log/backup.log 2>&1

The script contains the lftp call from above. Read the password from a file with 600 permissions — don’t hardcode it in the crontab or the script.

sftp in batch mode

For simple upload jobs, the OpenSSH built-in tooling is enough — with an SSH key and no password prompt, clean for cron:

sftp -i ~/.ssh/id_ed25519 -b - mueller@drive.xaweho.de <<EOF
put /local/report.pdf /home/mueller/Reports/
EOF

Auto-deployment with GitHub Actions

- name: Deploy via SFTP
  uses: SamKirkland/FTP-Deploy-Action@v4
  with:
    server: drive.xaweho.de
    protocol: sftp
    port: 22
    username: ${{ secrets.SFTP_USER }}
    password: ${{ secrets.SFTP_PASSWORD }}
    local-dir: ./dist/
    server-dir: /home/mueller/Deploy/

SFTP via sshfs as a mount

On Linux and Mac: an SFTP mount as a filesystem:

Linux (with sshfs)

sudo apt install sshfs
mkdir ~/storagedrive-mount
sshfs mueller@drive.xaweho.de:/home/mueller/ ~/storagedrive-mount/

Files appear in ~/storagedrive-mount/ as if on a local HDD. Performance comparable to WebDAV.

Unmount:

fusermount -u ~/storagedrive-mount

Mac (with macFUSE + sshfs)

Install macFUSE from osxfuse.github.io, then sshfs as on Linux.

Pitfalls

Wrong port

Some company firewalls block port 22. Workaround: WebDAV — runs over HTTPS on port 443, and that one is practically never closed.

Public key not accepted

• Did you send us the public key in full (including the ssh-ed25519 AAAA... header)?
• Permissions on the client side: ~/.ssh folder 700, key files 600
• Ticket sent just now? We register keys manually — wait for our confirmation

Very slow with many small files

SFTP has per-file setup overhead. lftp mirror with parallel connections (--parallel=4) speeds this up considerably.

Maximum size

SFTP servers accept files of any size. With very large ones (>50 GB) and an unstable connection: the transfer aborts and has to restart. lftp mirror --continue resumes aborted transfers.

SFTP vs FTPS — recommendation

Use case	Recommendation
Scripts, cron jobs	SFTP with a key
CLI workflows	SFTP
Auto-deployment	SFTP
Legacy industrial hardware	FTPS (if that’s all the hardware supports)
GUI browsing for occasional files	both similar, or better WebDAV

Frequently asked questions

Can I use ssh user@drive.xaweho.de for shell access? No. SSH shell is disabled. SFTP (sftp user@drive.xaweho.de) works.

Does SFTP still work with 2FA enabled? Yes — but beware: 2FA doesn’t apply here. SFTP always uses your account password, a 2FA code is never requested. Which is why: strong password, or better yet an SSH key.

Can I register multiple SSH keys? Yes. Send us all your public keys via ticket — e.g. one per device / script. We register them on the server side.

How fast is SFTP compared to the Drive client? The Drive client’s sync is smart: it only syncs diffs. SFTP transfers every file in full. For an initial migration: about the same. For repeated syncs: Drive is much faster, or lftp mirror --only-newer over SFTP.

Can I change permissions with SFTP? In a limited way. Standard Synology DSM users have no chmod rights at the system level — only within their home. For most workflows that’s no problem.

SFTP logs on the server side — do the server admins see them? Yes, login logs are on the server side. File operations are partially logged. For privacy-relevant setups, open a ticket — we can adjust the logging level on request.

Can I create sharing links via SFTP? No, SFTP is file transfer only. Share via the DSM web UI.

What if I accidentally sent the wrong SSH public key? Open a ticket with us, we’ll swap or remove the key. As long as your account password works, you’re not locked out.

What’s next

• FTPS access
• WebDAV access
• Mounting storageDRIVE as a drive (SMB)