Skip to content

Getting started

This page takes you from the AWS Marketplace listing to a working file drop: subscribe, launch, connect, and transfer a file. It takes about ten minutes.

You need: an AWS account with permission to subscribe to AWS Marketplace products and launch EC2 instances.

1. Subscribe

Open the OpenSSH SFTP Drop Box listing, review the pricing and terms, and subscribe.

2. Launch the instance

Launch from the listing with these settings:

  • Instance type: t3.medium.
  • Storage: at least 16 GiB, encrypted gp3. Uploaded files are stored on this volume, so size it for the files you expect.
  • Security group: no inbound rules are needed yet. SFTP listens on loopback only. If you want SSH, allow port 22 only from your own administrative address range.
  • IAM instance profile: to connect with AWS Systems Manager Session Manager, attach a role with the AWS managed policy AmazonSSMManagedInstanceCore. The SFTP service itself needs no AWS permissions.

3. Connect

Connect with Session Manager, from the EC2 console (Connect > Session Manager), and switch to the ubuntu user:

sudo -iu ubuntu

Wait for first boot to finish:

cloud-init status --wait

4. Run the walkthrough

The walkthrough must run as ubuntu:

bash /opt/sushi/docs/demo.sh

It checks that sushi-sftp-firstboot and sushi-sftp are active, uploads a sample file as the transfer user, downloads it again and compares the two, and checks that the user gets no shell and that password sign-in is refused. It then runs the image's self-test, and ends with SUSHI_CUSTOMER_DEMO_PASSED.

5. Connect as the transfer user

First boot creates the transfer user with an Ed25519 key pair. The private key is at /var/lib/sushi-sftp/customer/id_ed25519 and is readable only by root, so run the client with sudo:

sudo sftp -P 2222 -o IdentitiesOnly=yes \
  -o IdentityFile=/var/lib/sushi-sftp/customer/id_ed25519 transfer@127.0.0.1

The first time, the client asks you to confirm the server's key. Compare the fingerprint it shows with the SFTP service's own host key:

sudo ssh-keygen -lf /var/lib/sushi-sftp/hostkeys/ssh_host_ed25519_key.pub

You start in incoming/, the one folder you can write to. Try put, get and ls, then bye. On the instance, uploaded files are in /var/lib/sushi-sftp/jails/transfer/incoming/.

Keep private keys private

Do not change the permissions on the private key to make this command work, and never paste a private key into tickets, chat or screen recordings.

Next steps

Give your partners their own accounts and open SFTP to your network in Configuration.