Secure SFTP with FileZilla: Key‑Based Authentication Made Easy

Why Switch from Passwords to Keys?

Password‑based SFTP is straightforward but leaves credentials on the wire and makes brute‑force attacks trivial. Key‑based authentication eliminates the need for plaintext passwords, reduces the attack surface, and lets FileZilla log in automatically. This blog walks you through the exact steps to set it up, highlights trade‑offs, and shows how to verify that it works.

Step 1 – Generate a Strong Key Pair

Open a terminal on your client machine and run:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/filezilla_key

Choose a strong passphrase when prompted. The command creates two files: filezilla_key (private) and filezilla_key.pub (public). Keep the private key in a secure location and never share it.

Step 2 – Install the Public Key on the Server

Copy the public key to the server’s authorized_keys file for the user you’ll connect as.

cat ~/.ssh/filezilla_key.pub | ssh user@server "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Verify the file exists and has the correct permissions (600). If the server uses sshd_config restrictions, ensure PubkeyAuthentication yes is enabled.

Step 3 – Tell FileZilla to Use the Private Key

1. Open FileZilla and go to File → Site Manager.
2. Create or edit a site entry for the SFTP host.
3. Switch to the Advanced tab.
4. Check Use key file and browse to the filezilla_key file you generated earlier.
5. (Optional) In the General tab, set Logon Type to Normal and leave the password field empty.

FileZilla will now send the private key during the SSH handshake. If you set a passphrase, you’ll be prompted once per session; if you omitted it, the key is used automatically.

Step 4 – Verify the Connection

Connect to the site. If authentication succeeds without a password prompt, key auth is working.

To double‑check, enable verbose logging:
Edit → Settings → Logging → Log to file and check the log for entries like Key exchange: RSA and Authentication succeeded. On the server, look for Accepted publickey in /var/log/auth.log or equivalent.

Trade‑offs and Limitations

• Passphrase vs. No Passphrase: A passphrase protects the key if the file is stolen, but it requires manual entry unless you use an SSH agent. Omitting it speeds up automation but increases risk.
• Algorithm Support: Older FileZilla versions may not support newer algorithms like ECDSA or Ed25519. Verify your version (FileZilla 3.52+ supports RSA and ECDSA).
• Key Revocation: If a key is compromised, immediately remove it from authorized_keys and generate a new pair. FileZilla does not provide a built‑in revocation mechanism.
• Non‑Standard Formats: FileZilla only accepts PEM or OpenSSH formats. If you have a PKCS#12 or other format, convert it first.
• Server Configuration: Some SFTP servers may disable key authentication by default. Ensure PubkeyAuthentication yes and that the user’s home directory is writable.

Actionable Checklist

1. Generate an RSA 4096‑bit key pair with a strong passphrase.
2. Append the public key to the server’s authorized_keys with proper permissions.
3. Configure the site in FileZilla’s Site Manager to point to the private key.
4. Connect, verify logs on both sides, and confirm no password prompt.
5. Store the private key securely; revoke and regenerate if compromised.

By following these steps, you replace vulnerable password logins with robust, automated key‑based authentication in FileZilla, tightening security without sacrificing convenience.