SFTP / SSH

SFTP is a protocol for securely transferring files over SSH. The SFTP integration includes three connectors:

Requirements

• An SFTP/SSH server with appropriate read and write permissions.

Typical use cases

• Encrypted backups of remote Linux/BSD/application servers over SSH.
• Offsite or air-gapped snapshot storage by hosting a Kloset store on an SFTP server.
• Data recovery workflows: restore server trees over SSH to warm or cold standby.
• Centralized archiving of distributed environments into one Kloset.

Compatibility

• Works with standard OpenSSH SFTP.
• On‑prem, cloud, and hybrid deployments supported.
• Legacy or proprietary SFTP variants that diverge from SSH/SFTP standards are not supported.

Installation

The SFTP integration is distributed as a Plakar package. It can be installed either by downloading a pre-built package or by building it from source.

1$ plakar pkg add sftp

1$ plakar pkg list

1$ plakar pkg build sftp

1$ plakar pkg add ./sftp_v1.0.7_darwin_arm64.ptar

1$ plakar pkg list

1$ plakar pkg list

1$ plakar pkg rm sftp
2$ plakar pkg add sftp

Connectors

The SFTP package provides three connectors: a storage connector for hosting Kloset stores on SFTP servers, a source connector for backing up remote directories over SFTP, and a destination connector for restoring data over SFTP.

You can use any combination of these connectors together with other supported Plakar connectors.

Storage connector

The Plakar SFTP package provides a storage connector to host Kloset stores on SFTP servers.

Configure

 1# Configure the Kloset store
 2$ plakar store add sftp_store sftp://sftp-prod/backups
 3
 4# Initialize the Kloset store
 5$ plakar at @sftp_store create
 6
 7# List snapshots in the Kloset store
 8$ plakar at @sftp_store ls
 9
10# Verify integrity of the Kloset store
11$ plakar at @sftp_store check
12
13# Backup a local folder to the Kloset store
14$ plakar at @sftp_store backup /etc
15
16# Backup a source configured in Plakar to the Kloset store
17$ plakar at @sftp_store backup @my_source

Options

These options can be set when configuring the storage connector with plakar store add or plakar store set:

Source connector

The Plakar SFTP package provides a source connector to back up remote directories reachable over SFTP.

Configure

1# Configure a source pointing to the remote SFTP directory
2$ plakar source add sftp_src sftp://sftp-prod:/srv/data
3
4# Back up the remote directory to the Kloset store on the filesystem
5$ plakar at /var/backups backup @sftp_src
6
7# Or back up the remote directory to the Kloset store on SFTP created above
8$ plakar at @sftp_store backup @sftp_src

Options

These options can be set when configuring the source connector with plakar source add or plakar source set:

Destination connector

The Plakar SFTP package provides a destination connector to restore snapshots to remote directories reachable over SFTP.

Configure

1# Configure a destination pointing to the remote SFTP directory
2$ plakar destination add sftp_dst sftp://sftp-prod:/srv/restore
3
4# Restore a snapshot from a filesystem-hosted Kloset store to the remote SFTP directory
5$ plakar at /var/backups restore -to @sftp_dst <snapshot_id>
6
7# Or restore a snapshot from the Kloset store on SFTP created above to the remote SFTP directory
8$ plakar at @sftp_store restore -to @sftp_dst <snapshot_id>

Options

These options can be set when configuring the destination connector with plakar destination add or plakar destination set:

SSH best practices for reliability

Create a host alias (recommended)

Define an alias in ~/.ssh/config so Plakar commands stay concise and stable:

Host sftp-prod
    HostName host.example.com
    User sftpuser
    Port 22
    IdentityFile ~/.ssh/id_ed25519_plakar

Test the alias:

1$ sftp sftp-prod

Then reference it in Plakar URLs:

1$ plakar store add sftp_store sftp://sftp-prod/backups
2$ plakar source add sftp_src sftp://sftp-prod:/srv/data
3$ plakar destination add sftp_dst sftp://sftp-prod:/srv/restore

Use key‑based, passwordless SSH

Unattended jobs must not prompt for passwords.

1$ ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_plakar -C plakar@backup
2$ ssh-copy-id -i ~/.ssh/id_ed25519_plakar.pub sftpuser@host.example.com
3$ sftp -i ~/.ssh/id_ed25519_plakar sftpuser@host.example.com

If your private key is encrypted, run an agent:

1$ eval "$(ssh-agent -s)"
2$ ssh-add ~/.ssh/id_ed25519_plakar

Host keys and trust

For production, keep strict host key checking enabled and manage ~/.ssh/known_hosts normally. Avoid disabling host key checks except in isolated test environments.

Limitations and scope

What is captured during backup

• Files and directories reachable under the specified SFTP path
• File metadata (timestamps, permissions, sizes)

What is not captured

• System configuration outside the backed‑up path (e.g., SSHD config, firewall rules)
• OS user and group database, running processes, or service state
• SSH server settings and known_hosts

Snapshot consistency

Changes during backup (creates, updates, deletes) may result in a snapshot that reflects different points in time for different files. For highly dynamic paths, consider quiescing the workload or backing up from a read‑only replica.

Troubleshooting

Authentication or permission errors

• Validate the SSH key, username, and target path permissions.
• Ensure the SFTP subsystem is enabled on the server.

Host key verification failed

• Connect once interactively to record the host key in ~/.ssh/known_hosts.
• Only use insecure_ignore_host_key=true-style options in disposable test environments.

Chroot or path issues

• If the server uses chrooted SFTP, verify the effective path inside the chroot matches your URL.

Passphrase prompts

• Use ssh-agent to cache the key, or deploy a dedicated non‑encrypted key restricted to the backup account.

FAQ

How do I set username, port, or identity file?

Prefer SSH config (~/.ssh/config) with a host alias.

Can I move snapshots between two SFTP‑hosted stores?

Yes. Define two stores, then use plakar at @store1 sync to @store2 to synchronize them.

See also

• Plakar Architecture (Kloset Engine)
• OpenSSH / SFTP Documentation