DriveHQ SFTP Server  -  Secure FTP (SFTP over SSH) Hosting Service

SFTP (SSH File Transfer Protocol) is a network protocol that provides file access, file transfer and file management over a secure, encrypted data stream. It was designed by the Internet Engineering Task Force (IETF) as an extension of the Secure Shell protocol (SSH) 2.0. Unlike plain FTP, which sends credentials and data in clear text, SFTP encrypts both the logon credentials and the transferred data, and it uses only a single port.

DriveHQ hosts a cloud SFTP server. Any standard SFTP/SSH client or script can connect to it securely and access the files stored in your DriveHQ cloud storage. Because DriveHQ is a complete cloud file server – not just an FTP storage account – the files you access over SFTP are the same files you manage on the DriveHQ website, in DriveHQ FileManager and over WebDAV, including folders shared with you and folders you publish.

On this page

• 1. Server Basic Information
• 2. Server Host Key and Fingerprints
• 3. Log On with Username / Password
• 4. Log On with a Public / Private Key File
• 5. Supported SFTP Clients
• 6. Supported Scripts and Command-Line Tools
• 7. Security – Supported Algorithms
• 8. Advanced Features and Tips

1. Server Basic Information

Please note the difference between SFTP and FTPS: SFTP runs over SSH on port 22, whereas FTPS (FTP over TLS/SSL) is an extension of the classic FTP protocol (DriveHQ's plain FTP service uses port 21). The two protocols are not interchangeable; when you configure your client make sure you select the SFTP / SSH protocol, not “FTP”, “FTP over SSL” or “FTPS”.

Top

2. Server Host Key and Fingerprints

When you connect for the first time, your SFTP client will display the server's host-key fingerprint and ask you to verify it. The host key proves the identity of the server, protecting you from man-in-the-middle attacks. Please verify that the fingerprint shown by your client matches one of the fingerprints below before you accept and cache the key.

DriveHQ presents host keys of several types and lengths so that both modern and legacy clients can connect. For each host key, the first line is the Base64 (SHA-256 style) fingerprint and the second line is the MD5 (colon-delimited) fingerprint, both in the format key-type key-length fingerprint:

You only need to verify the single fingerprint that your client negotiates (typically the strongest key type both sides support). After you accept it, the client stores the key and will warn you if it ever changes.

Top

3. Log On with Username / Password

Password authentication is the simplest method and requires no extra setup:

1. Open your SFTP client and create a new site / connection.
2. Set the protocol to SFTP – SSH File Transfer Protocol.
3. Enter the host name ftp.drivehq.com, port 22.
4. Enter your DriveHQ username and password. Leave the remote / startup directory blank (or enter “/”).
5. Connect. The first time, verify the host-key fingerprint against the table in section 2 and accept it.

With OpenSSH on Mac, Linux or Windows 10/11 you can log on directly from a terminal:

Or open an interactive shell session:

To avoid the interactive password prompt in scripts, use public-key authentication (below) or an interactive password helper provided by your scripting tool. Never hard-code your DriveHQ password inside a script.

Top

4. Log On with a Public / Private Key File

Public-key authentication is more secure than a password and is ideal for unattended, scripted access. You create a key pair consisting of a private key (kept secret on your computer) and a public key (uploaded to your DriveHQ account). During logon the server proves that it holds the matching public key without your private key ever leaving your machine.

Step 1 – Generate a key pair

Detailed, platform-by-platform instructions are available on the Generate SFTP/SSH Secure Key Pair help page. In short:

• Windows: use the free PuTTYgen tool. Choose RSA (or Ed25519), click Generate, move the mouse, then save the private key (.ppk) and copy the public-key text.
• Mac / Linux: run the built-in command
  ssh-keygen -t rsa -b 4096
  The private key is saved to ~/.ssh/id_rsa and the public key to ~/.ssh/id_rsa.pub. You may add a passphrase to protect the private key.

Both OpenSSH format keys and PuTTY (.ppk) keys work; if a tool requires OpenSSH format (for example the Microsoft SFTP-SSH connector), export or convert the key with PuTTYgen (Conversions → Export OpenSSH key).

Step 2 – Add the public key to your DriveHQ account

Log on to the DriveHQ website, open your Account / Security page and choose Manage SFTP Secure Key Pair. Paste the entire public-key text (the contents of the .pub file) into the Public Key box and save it. (Managing SFTP key pairs is available on paid / enterprise plans.)

Step 3 – Connect with the private key

• In a GUI client (FileZilla, WinSCP, Cyberduck...), set the logon type to Key file / Private key and browse to your private-key file.
• On the command line:
  sftp -i ~/.ssh/id_rsa username@ftp.drivehq.com

If the private key is protected with a passphrase, you will be prompted for it. Do not edit or retype the private-key contents by hand; always point the client to the key file or paste the complete key text exactly as generated, otherwise the connection can fail.

Top

5. Supported SFTP Clients

DriveHQ's SFTP server implements the standard SSH File Transfer Protocol, so virtually any SFTP client works. You can also keep using DriveHQ FileManager, which requires no configuration and adds sharing, publishing, synchronization and folder-permission features. Popular third-party clients include:

When configuring any of these, use host ftp.drivehq.com, port 22, protocol SFTP/SSH, and authenticate with your DriveHQ password or a registered private key. Microsoft's SFTP-SSH connector uses an MD5 host-key fingerprint; use the matching colon-delimited fingerprint listed in section 2.

Top

6. Supported Scripts and Command-Line Tools

Because the server speaks standard SFTP, it can be driven from batch files, shell scripts and programs. Public-key authentication is recommended so that scripts can run unattended without storing a password.

DriveHQ CommandFTP (recommended on Windows)

DriveHQ CommandFTP is a free, powerful command-line FTP/SFTP/FTPS client designed to replace the built-in Windows ftp.exe. It uses the same interactive commands and -s: script syntax as the Windows FTP client, but adds SFTP support, so you can run an existing FTP script file against the SFTP server without rewriting it. It works with any standard FTP/SFTP server; a DriveHQ account is not required to use the software. Features include:

• FTP, FTPS (implicit/explicit SSL/TLS) and SFTP over SSH, active and passive mode
• SFTP private-key authentication with the -k option
• Advanced FTP/SFTP scripting with script parameters (%1, %2, ...)
• Automatic retry and resume, data compression and encryption
• Folder upload/download, mirroring and synchronization
• Event logging for auditing/troubleshooting and optional email reports
• Unattended automation with Windows Task Scheduler

Download: cmdFTP.exe  |  Full manual: Command-line FTP Scripting with DriveHQ CommandFTP

A reusable script file (ftpscript.txt) accepts parameters passed on the command line:

Pair the command with Windows Task Scheduler to run daily, weekly, hourly or at logon for fully automated, server-to-server backup and file-transfer jobs. See the CommandFTP manual for the complete command reference and advanced commands.

OpenSSH sftp / scp (Mac, Linux, Windows 10/11)

Windows batch / PowerShell with WinSCP

WinSCP ships a scriptable console and a .NET assembly usable from PowerShell, VBScript, C# and SSIS. A simple script file:

Windows PuTTY PSFTP

Linux / Unix shell scripts and cron jobs

Programming languages

Any SSH/SFTP library can connect, for example:

• Python: Paramiko / pysftp / Fabric
• Java / JVM: JSch, Apache MINA SSHD, sshj
• .NET (C# / VB.NET): SSH.NET (Renci.SshNet), WinSCP .NET assembly
• PHP: phpseclib, libssh2 (ssh2 extension)
• Node.js: ssh2 / node-ssh
• Ruby: Net::SFTP (net-sftp)
• Go: golang.org/x/crypto/ssh and sftp packages
• PowerShell: the built-in OpenSSH client, Posh-SSH module, or WinSCP .NET

These libraries are the same engines behind workflow products such as the Microsoft SFTP-SSH connector (which uses the open-source SSH.NET library), so automated, scheduled and server-to-server transfers are all supported.

Top

7. Security – Supported Algorithms

All SFTP traffic – authentication and data – is encrypted in transit using SSH-2. The server negotiates the strongest mutually supported algorithm with your client. The lists below are provided for configuring firewalls, hardened clients, connectors and enterprise security scans.

Host-key algorithms

• rsa-sha2-256
• rsa-sha2-512
• ssh-ed25519
• ecdsa-sha2-nistp256
• ecdsa-sha2-nistp384
• ecdsa-sha2-nistp521
• ssh-rsa (legacy / less secure)
• ssh-dss (legacy / less secure)

Key-exchange algorithms

• curve25519-sha256
• curve25519-sha256@libssh.org
• ecdh-sha2-nistp256
• ecdh-sha2-nistp384
• ecdh-sha2-nistp521
• diffie-hellman-group14-sha256
• diffie-hellman-group-exchange-sha256
• diffie-hellman-group14-sha1 (legacy / less secure)
• diffie-hellman-group-exchange-sha1 (legacy / less secure)
• diffie-hellman-group1-sha1 (legacy / less secure)

Encryption (cipher) algorithms

• aes256-ctr (recommended)
• aes192-ctr (recommended)
• aes128-ctr (recommended)
• aes256-cbc
• aes192-cbc
• aes128-cbc
• 3des-cbc (legacy / less secure)

MAC (hash / integrity) algorithms

• hmac-sha2-512
• hmac-sha2-256
• hmac-sha1 (legacy / less secure)

Compression algorithms

• none
• zlib

Security recommendations

1. Keep your SFTP client and operating system up to date so that strong algorithms (curve25519, ECDH, AES-CTR, SHA-2) are negotiated.
2. Prefer public-key authentication over passwords for servers and automated jobs; protect the private key with a passphrase and restrictive file permissions.
3. Always verify the server's host-key fingerprint on first connection (see section 2) and never accept a changed key without confirming it with DriveHQ.
4. Upload only your public key to DriveHQ; never share the private key.
5. Use the firewall friendly, single-port nature of SFTP: only outbound (and the server's listener) port 22 is required – no passive port range as with plain FTP.
6. Enterprise customers can additionally enable two-factor authentication (2FA), dedicated IP access and group sub-account controls; contact DriveHQ sales for details.

Top

8. Advanced Features and Tips

• A true cloud file server. SFTP connects to your DriveHQ virtual root folder. Files uploaded over SFTP immediately appear on the DriveHQ website, FileManager and WebDAV, and vice versa.
• Shared and published folders. Folders shared with you are available under /DriveHQShare/..., with the read/write permissions granted by the owner; published folders can be accessed as allowed by their publish settings.
• Sub-accounts and groups. Group administrators can create and manage sub-users who each authenticate over SFTP with their own credentials or keys, subject to centrally assigned folder permissions and storage quotas.
• Automation and scheduling. Combine key-based logon with cron (Linux/Mac), Task Scheduler (Windows), SSIS, or workflow platforms (Azure Logic Apps, Power Automate) for unattended backup, sync and server-to-server file exchange.
• File versioning and recycle bin. Files transferred through SFTP benefit from DriveHQ's file-version history and recycle-bin features, so overwritten or deleted files can often be recovered.
• Resumable and large-file transfers. Modern clients (WinSCP, FileZilla, rclone) support transfer resume, synchronization and large-file handling; use binary/auto transfer mode and enable compression (zlib) where beneficial.
• Firewall friendly. SFTP uses a single TCP connection on port 22, avoiding the multiple inbound ports and active/passive-mode problems of classic FTP.
• Interoperability. If a connector or hardened client rejects an older cipher, configure it to use the modern algorithms in section 7 (for example rsa-sha2-256/512, curve25519-sha256, aes256-ctr, hmac-sha2-256/512). Conversely, very old legacy systems can fall back to the ssh-rsa / DSS / SHA-1 options still offered by the server.

Troubleshooting checklist

1. Connection refused / timeout: confirm host ftp.drivehq.com, port 22, protocol SFTP (not FTP/FTPS), and that outbound port 22 is not blocked by your firewall.
2. Authentication failed: verify your DriveHQ username/password, or confirm that the public key was saved to your account and that the client uses the matching private key.
3. Host-key mismatch warning: a changed key can indicate a man-in-the-middle attack; re-check the fingerprint against section 2 or contact DriveHQ support before accepting.
4. “No supported authentication/cipher” errors: upgrade the client, or enable a mutually supported algorithm listed in section 7.
5. Scripted logon hangs waiting for a password: switch to private-key authentication instead of embedding the password.

Related help: FTP Server Hosting Service FAQ | Generate SFTP/SSH Secure Key Pair | Manage SFTP Secure Key Pair

Top