Enable SFTP for Extra FTP Users in Plesk with ProFTPD

Providing secure file-transfer access for multiple users is a common requirement for web-hosting clients. While Plesk’s built-in FTP service works well for basic needs, many administrators prefer to use ProFTPD because it offers finer-grained control, better logging, and native SFTP support when run as a dedicated instance. In this guide, we walk through the entire process of enabling SFTP access for additional FTP accounts in Plesk by creating a dedicated ProFTPD instance.

Why Use a Dedicated ProFTPD Instance for SFTP?

• Separate configuration – Tune ProFTPD settings without affecting the default Plesk FTP service.
• Native SFTP support – The mod_sftp module provides true SFTP (SSH-based) without requiring an extra SSH daemon.
• Per-customer isolation – Bind each instance to a specific IP address or port to enforce quotas and security policies per client.
• Enhanced logging – Dedicated logs simplify troubleshooting and audit compliance.

Prerequisites

• Plesk 18.0+ installed on a Linux server (Debian/Ubuntu or AlmaLinux/Rocky/RHEL). The steps are split for both package managers.
• Root or sudo access to the server.
• At least one existing FTP subscription in Plesk that you want to expose via SFTP.
• Open port 22 (or an alternative port you plan to use) in the firewall.

1. Install ProFTPD with the SFTP Module

ProFTPD is not installed by default in Plesk. You need the proftpd-mod-sftp package, which provides the mod_sftp module.

Debian / Ubuntu (apt)

# Update the package index
apt-get update

# Install ProFTPD core and the SFTP module
apt-get install proftpd-basic proftpd-mod-sftp

# Verify installation
proftpd -v

The first command refreshes the local package list. The second installs the main ProFTPD daemon and the optional SFTP module. The final command prints the version to confirm the binary is available.

AlmaLinux / Rocky / RHEL (dnf)

# Enable the EPEL repository (required for ProFTPD)
dnf install epel-release

# Install ProFTPD and the SFTP module
dnf install proftpd proftpd-mod-sftp

# Verify installation
proftpd -v

On RHEL-based systems, the Extra Packages for Enterprise Linux (EPEL) repository provides ProFTPD. The rest of the commands mirror the Debian steps.

2. Create a Dedicated ProFTPD Instance in Plesk

Plesk can manage multiple ProFTPD instances. We’ll create one that runs on a custom port (e.g., 2222) and is bound to the IP address of the domain you want to serve.

Step-by-step in the Plesk UI

1. Log in to Plesk as admin.
2. Navigate to Tools & Settings > Services Management.
3. Click ProFTPD and then Add Instance.
4. Enter a descriptive name (e.g., proftpd-sftp-clientA).
5. Set Listen IP address to the IP of the target domain.
6. Set Port to 2222 (or any unused port).
7. Leave the Default configuration option unchecked – we’ll supply a custom config file later.
8. Click OK to create the instance.

After creation, Plesk generates a configuration file under /etc/proftpd/instances/ (e.g., /etc/proftpd/instances/proftpd-sftp-clientA.conf).

3. Configure the Instance for SFTP

Open the newly created configuration file and enable the SFTP module, define authentication methods, and restrict access to the desired FTP accounts.

Example Configuration (common for both OS families)

# /etc/proftpd/instances/proftpd-sftp-clientA.conf

# Load the SFTP module
LoadModule mod_sftp.c

# Enable SFTP on the same port the instance listens on
SFTPEngine on
SFTPLog /var/log/proftpd/sftp.log
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_ecdsa_key
SFTPHostKey /etc/ssh/ssh_host_ed25519_key

# Use the same authentication as the system (Plesk stores users in /etc/passwd)
AuthUserFile /etc/proftpd/ftpd.passwd
AuthGroupFile /etc/proftpd/ftpd.group

# Restrict SFTP to the users belonging to the “ftpusers” Unix group

  AllowGroup ftpusers
  DenyAll


# Chroot each user to their home directory (recommended for security)
DefaultRoot ~

Explanation of key directives:

• LoadModule mod_sftp.c – Loads the SFTP support module.
• SFTPEngine on – Activates SFTP handling.
• SFTPHostKey – Points to existing SSH host keys, avoiding the need to generate new ones.
• AuthUserFile /etc/proftpd/ftpd.passwd – Uses the same password file that Plesk creates for its FTP users.
• AllowGroup ftpusers – Only users in the Unix group ftpusers can log in via SFTP. We’ll add our additional accounts to this group.
• DefaultRoot ~ – Restricts each session to the user’s home directory, preventing directory traversal.

4. Add Additional FTP Accounts to the SFTP-Enabled Group

When you create a new FTP subscription in Plesk, the system automatically adds a Unix user and places it in the ftpusers group. However, if you need to grant SFTP access to an existing account that is not in that group, follow these steps.

Debian / Ubuntu

# Find the Unix username for the FTP subscription (replace example.com)
grep example.com /etc/passwd

# Add the user to the ftpusers group
usermod -a -G ftpusers ftpuser123

# Verify group membership
id ftpuser123

usermod -a -G appends the user to the supplemental group without removing existing groups.

AlmaLinux / Rocky / RHEL

# Find the Unix username for the FTP subscription
grep example.com /etc/passwd

# Add the user to the ftpusers group
usermod -a -G ftpusers ftpuser123

# Verify
id ftpuser123

5. Restart the Dedicated Instance and Test the Connection

After editing the configuration, restart only the instance you created. This avoids disrupting the default Plesk FTP service.

Restart Command (both OS families)

# Replace instance name with the one you created
systemctl restart proftpd@proftpd-sftp-clientA

The @ syntax tells systemd to manage the specific instance configuration file.

Testing with an SFTP client

1. Open FileZilla, WinSCP, or any SFTP client.
2. Enter the server’s IP, port 2222, and the FTP username/password.
3. Connect using the SFTP – SSH File Transfer Protocol option.
4. If the connection succeeds, you should be landed in the user’s home directory and be unable to navigate above it.

If the login fails, check the log file defined earlier (/var/log/proftpd/sftp.log) for detailed error messages.

6. Fine-Tuning and Security Considerations

• Limit login attempts – Add MaxLoginAttempts 3 inside a <Limit LOGIN> block to mitigate brute-force attacks.
• Disable password authentication (optional) – If you want key-based SFTP only, set SFTPAuthMethods publickey and distribute SSH keys to your users.
• Firewall rules – Ensure the chosen port is allowed in iptables, firewalld, or any external firewall device.
• Separate logs per client – Add TransferLog /var/log/proftpd/sftp-%u.log to create per-user logs for audit purposes.
• Regular updates – Keep ProFTPD and its modules up to date via the system package manager to receive security patches.

Conclusion

By creating a dedicated ProFTPD instance and enabling mod_sftp, you give Plesk customers a secure, isolated SFTP endpoint without interfering with the default FTP service. The process involves installing ProFTPD with the SFTP module, configuring a new instance, adding the desired FTP accounts to the authorized group, and restarting the instance. With the optional hardening steps, you can provide a robust file-transfer solution that meets the security expectations of Indian businesses hosting websites, applications, and servers on AtoZNode’s cloud infrastructure.