Using SFTP Key‑Based Authentication in FileZilla Site Manager – Setup, Security Trade‑offs, and Verification

Problem: avoiding plaintext passwords in FileZilla SFTP profiles

When you save an SFTP site in FileZilla’s Site Manager, the default logon type stores the server password in plain text (or only lightly obfuscated). If the FileZilla configuration directory is accessible to other users or backup tools, that password can be read. For environments that rely on key‑based authentication, you want to keep the private key out of the profile and avoid storing any password at all.

Setting up key‑file authentication in Site Manager

1. Open FileZilla and choose File → Site Manager.
2. Click New Site, give it a name (e.g., my‑sftp‑server).
3. On the General tab set Protocol to SFTP – SSH File Transfer Protocol and fill in the host and port.
4. Change Logon Type from Normal to Key file.
5. Click the Browse button next to the key file field and select your private key. FileZilla reads PuTTY .ppk files directly; if you have an OpenSSH key, convert it with puttygen or load it via an agent (see next section).
6. If the key is protected by a passphrase, leave the Password field empty; FileZilla will prompt you for the passphrase when the connection starts.
7. Click Connect to test the entry.

Using Pageant (Windows SSH agent) to avoid passphrase prompts

If you prefer not to type the passphrase for each session, run Pageant, load your private key into it, and then:

1. In Site Manager keep the Logon Type set to Key file but clear the key‑file path (or keep it; FileZilla will ignore it if an agent supplies the key).
2. Make sure Pageant is running and holds the key.
3. When you connect, FileZilla will ask the agent for the key, so no passphrase dialog appears.

This approach keeps the private key material in memory only, reducing the chance that a stray copy of the key file is left on disk.

Security trade‑offs: master password and exported profiles

FileZilla can encrypt saved credentials with a master password:

• Enable it via Edit → Settings → Interface → Master password.
• After setting a master password, FileZilla encrypts stored server passwords and key‑file passphrases using AES‑256.
• Without a master password, credentials are only obfuscated (XOR with a fixed key) and can be recovered by anyone who can read the sitemanager.xml file.

Exporting a site (File → Export → Export selected entries) writes the full XML snippet, including any encrypted or obfuscated credential fields. If you share that export, you may unintentionally expose secrets unless you have removed the credential lines first.

Verifying that key‑based authentication succeeded

After a successful connection, open the message log (View → Message log). You should see lines similar to:

Status: Connecting to sftp.example.com:22...
Trace:   Looking up host "sftp.example.com"
Trace:   Connecting to 203.0.113.10 port 22
Trace:   We claim version: SSH-2.0-FileZilla_3.66.0
Trace:   Server version: SSH-2.0-OpenSSH_8.9
Trace:   Using SSH protocol version 2
Trace:   Doing Diffie-Hellman key exchange with curve Curve25519
Trace:   Host key fingerprint is:
Trace:   ssh-ed25519 255 SHA256:AbCdEfGhIjKlMnOpQrStUvWxYz1234567890abcd
Trace:   Authenticating with public key "imported-openssh-key"
Trace:   Access granted

The presence of “Authenticating with public key” and the absence of a password prompt confirms that key‑based authentication was used. You can cross‑check the fingerprint shown (SHA256:…) with the public key you placed on the server (ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub or the user’s authorized_keys entry).

Limitation and practical check

Even with key‑file authentication, the security of the setup depends on the operating system’s user account. If an attacker gains read access to your Windows profile or Linux home directory, they can copy the private key file (if stored outside FileZilla) or extract the master‑password‑encrypted blob and attempt offline cracking. Therefore:

• Store the private key in a location with restrictive permissions (e.g., chmod 600 on Linux, or a folder accessible only to your user on Windows).
• Use a strong master password if you choose to enable FileZilla’s encryption.
• Avoid exporting sites unless you first delete the Pass and KeyFile attributes from the XML or manually edit the export.

To verify that your key file is protected, after connecting, run a quick permission check:

# Linux example
ls -l ~/.ssh/id_ed25519
# Should show -rw------- 1 user user  ...  id_ed25519

On Windows, right‑click the key file, choose Properties → Security, and confirm that only your user account has read access.

Actionable closing

By setting the logon type to Key file, optionally using Pageant, and protecting stored credentials with a master password, you can keep passwords out of FileZilla’s configuration while still enjoying the convenience of saved SFTP sites. Always verify the authentication method in the message log and keep the private key file permission‑tight. When you need to share a site configuration, export it only after stripping credential fields or after confirming that the master password is in place and the export is encrypted.