{"id":544,"date":"2026-08-04T22:54:30","date_gmt":"2026-08-04T22:54:30","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=544"},"modified":"2026-10-03T22:07:13","modified_gmt":"2026-10-03T22:07:13","slug":"setting-up-ftp-sftp-on-windows-vps-iis-ftp-vs-openssh","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/setting-up-ftp-sftp-on-windows-vps-iis-ftp-vs-openssh\/","title":{"rendered":"FTP vs SFTP vs FTPS on a Windows VPS: IIS FTP vs OpenSSH Setup and Security"},"content":{"rendered":"\n

Moving files to and from a Windows VPS is a solved problem, yet it is one of the most common support tickets. The confusion is usually terminology: FTP, FTPS, and SFTP are three different things, and Windows Server ships first-class support for all three. This article explains the differences with real port numbers and crypto details, then walks through both the IIS FTP role and OpenSSH-based SFTP so you can choose deliberately.<\/p>\n\n\n\n

FTP, FTPS, and SFTP are not the same<\/h2>\n\n\n\n
Protocol<\/th>Default port<\/th>Encryption<\/th>Windows role<\/th><\/tr><\/thead>
FTP<\/td>21<\/td>None (cleartext)<\/td>IIS FTP Server<\/td><\/tr>
FTPS (explicit)<\/td>21<\/td>TLS<\/td>IIS FTP Server + cert<\/td><\/tr>
SFTP<\/td>22<\/td>SSH transport<\/td>OpenSSH Server<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Plain FTP sends credentials and data in the clear and should be considered retired. FTPS wraps the classic FTP conversation in TLS \u2014 useful when a partner’s tooling only speaks FTP. SFTP is an entirely different protocol tunneled over SSH, has a single port, and works through NAT far more cleanly. If you control both ends, SFTP is the better default.<\/p>\n\n\n\n

Option A: IIS FTP with explicit TLS<\/h2>\n\n\n\n

Install the role with Install-WindowsFeature Web-Ftp-Server -IncludeManagementTools<\/code>. Then create the site and bind a certificate:<\/p>\n\n\n\n

New-WebFtpSite -Name \"CorpFTP\" -Port 21 -PhysicalPath \"D:\\ftp\\corp\"\nSet-ItemProperty \"IIS:\\Sites\\CorpFTP\" -Name ftpServer.security.ssl.controlChannelPolicy -Value 2\nSet-ItemProperty \"IIS:\\Sites\\CorpFTP\" -Name ftpServer.security.ssl.dataChannelPolicy -Value 2\nSet-ItemProperty \"IIS:\\Sites\\CorpFTP\" -Name ftpServer.security.authentication.basicAuthentication.enabled -Value $true<\/code><\/pre>\n\n\n\n
Setting both control and data channel policy to 2<\/code> forces TLS on every connection, which also means you must open a passive port range in the firewall. Configure ftpServer.security.ssl.serverCertHash<\/code> with your certificate thumbprint. A common failure is forgetting the passive range, resulting in successful login but failed directory listing.<\/p>\n\n\n\n
Option B: OpenSSH SFTP<\/h2>\n\n\n\n
Windows Server includes an OpenSSH Server capability. Install it, start the service, and SFTP is available on port 22 using local Windows accounts or an authorized_keys file.<\/p>\n\n\n\n
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0\nStart-Service sshd\nSet-Service -Name sshd -StartupType Automatic\nNew-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22<\/code><\/pre>\n\n\n\n
To restrict key-based login to SFTP only, edit sshd_config<\/code> and set the internal-sftp subsystem, then restart the service. Key authentication removes password brute-force risk entirely, which matters because SSH is scanned constantly on public IPs.<\/p>\n\n\n\n
Which to choose<\/h2>\n\n\n\n