Skip to content

OpenSSH SFTP Drop Box

OpenSSH SFTP Drop Box is a file drop on Ubuntu 24.04: partners upload and download files over SFTP, each locked into their own folder, with key-based sign-in only and no shell. It runs as a separate SFTP service, so the instance's own SSH access is unchanged. It answers on loopback only until you open it to your network.

Launch on AWS Marketplace Getting started

What is pre-installed

  • OpenSSH, 9.6p1 series, from Ubuntu's signed packages: openssh-server, openssh-sftp-server and openssh-client.
  • A standalone SFTP service, sushi-sftp.service, a second sshd with its own configuration at /opt/sushi/etc/sftp/sshd_config, its own host key, and port 2222.
  • A first-boot service, sushi-sftp-firstboot.service, that creates the transfer user, its folder and a key pair.
  • A helper to add more users: /opt/sushi/bin/sftp-prepare-user.sh.
  • A walkthrough script at /opt/sushi/docs/demo.sh.

Nothing secret is baked into the image. Keys and users are created on your instance on first boot.

How users are isolated

  • Every SFTP user belongs to the sftpusers group and is locked into its own folder, /var/lib/sushi-sftp/jails/<user>. It cannot see the rest of the server or other users' folders.
  • Each user can write only in its incoming/ folder, where a session starts.
  • Sign-in is by public key only. Passwords, shells, and port, agent and X11 forwarding are all turned off.

Ports

Address What it is
127.0.0.1:2222 The SFTP service

There is no inbound service port, and you do not need any inbound security group rule until you open SFTP to other hosts.

How billing works

The software is billed by the hour while an instance is running, on the t3.medium instance type. AWS bills EC2, EBS and data transfer separately. The current price and any free trial are shown on the AWS Marketplace listing and in the offer terms.

Note

This is a single-instance file drop: not a cluster, not an S3 mount, and not a web file manager. All files are stored on the instance's root volume.

Where to go next

Upstream project

OpenSSH is developed by the OpenBSD project and published under BSD-style licenses. This image uses Ubuntu's OpenSSH packages. Software Sushi packages it independently and does not claim upstream endorsement. For the configuration reference, see the OpenSSH manual pages.