Guidelines on Setup of SFTP

Below are suggested guidelines of system configuration for SFTP setup:

1. Make sure the standard FTP is disabled.
2. Using strong encryption and hashing algorithms.
3. Avoid being internet facing.
4. Only use SSH-2 and disable support of SSH-1.
5. Only whitelist specific IP addresses to access the system.
6. Grant only minimum access rights to SFTP user accounts. Restrict user privilege and file/folder access.
7. Restrict specific user to login from specific IP only.
8. Do not share or reuse user accounts.
9. Use strong password and regularly change it.
10. Limit the number of fail attempts.
11. Create SSH Key with key size 4096 bits.
12. Regular rotation of SSH Keys.
13. For interactive sessions (not automated file transfer between servers), make use of other 2FA options, such as SSH Key+DUO or Password+DUO instead.
14. Retain authentication logs and access logs for regular reviews.