SFTPGo

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size for more concurrent transfers.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, 80/tcp for the web admin and web client, and 2022/tcp for SFTP. The web admin serves plain HTTP on port 80, so for production terminate TLS in front of it with your own domain. The HTTP server listens on 127.0.0.1:8080 only, so port 8080 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for SFTPGo by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80), then add a custom rule for 2022 so clients can reach SFTP.

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:sftpgo-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name sftpgo \
  --image sac1647283583153:sftpgo-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the web admin and 2022 for SFTP:

az vm open-port --resource-group <your-rg> --name sftpgo --port 80 --priority 900
az vm open-port --resource-group <your-rg> --name sftpgo --port 2022 --priority 910

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that SFTPGo and nginx are active. The HTTP server listens only on 127.0.0.1:8080, nginx serves the web admin on port 80, and SFTP listens on 2022.

systemctl is-active sftpgo nginx sftpgo-firstboot

sudo ss -tlnp | grep -E ':80 |:8080 |:2022 ' | sed 's/ */ /g'

Step 4 - Read the first-visit info note

SFTPGo ships with no administrator account. On the first boot of every VM, a one-shot service writes an instance info note that records the site URL and the create-admin instruction. The note contains no password, because you set your own on the first visit. Read it with sudo:

sudo cat /root/sftpgo-credentials.txt

To confirm the server is healthy, query the health endpoint. It returns 200:

curl -s -o /dev/null -w 'GET /healthz -> HTTP %{http_code}\n' http://127.0.0.1/healthz

Step 5 - Create your admin on first visit

Browse to http://<vm-public-ip>/. Because the image ships with no administrator, SFTPGo opens on its create admin setup page.

Choose a username and a strong password, then select the create button. This one screen secures the instance. There are no default credentials to change, because none ship.

Step 6 - The admin dashboard

After you create your admin, sign in to the web admin. The status page confirms the enabled protocols and the running version. Use the left navigation to manage users, groups, folders, roles, events and connections.

Step 7 - Create users and set permissions

Open Users to see the accounts list, then add a user. For each user, set a home directory, a login method (password or public key), granular per-directory permissions, quotas and bandwidth limits. Every account is then scoped to exactly what it needs.

Step 8 - Connect over SFTP

After you create a user in the web admin, connect from any SFTP client on port 2022. From a workstation with OpenSSH, run:

sftp -P 2022 <your-user>@<vm-public-ip>

Use put and get to transfer files. The same accounts also work over FTPS and WebDAV once you enable those protocols (Step 11). SFTPGo enforces the per-user permissions, quotas and bandwidth limits you configured.

Step 9 - Verify the stack

Confirm the SFTPGo version, that both services are enabled, that the web admin responds through nginx, and that the dedicated data disk is mounted:

/usr/local/bin/sftpgo --version

systemctl is-enabled sftpgo nginx

curl -s -o /dev/null -w 'GET /web/admin/login -> HTTP %{http_code}\n' -L http://127.0.0.1/web/admin/login

findmnt -no SOURCE,TARGET,FSTYPE /srv/sftpgo

Step 10 - Where your data lives

The accounts database, every served file and the per-instance SFTP host keys all live on a dedicated Azure data disk mounted at /srv/sftpgo, separate from the OS disk. The disk is captured into the image and re-provisioned on every VM, and you can snapshot and resize it independently. Confirm the mount and the free space:

df -h /srv/sftpgo | tail -1

sudo du -sh /srv/sftpgo/data

Step 11 - Enable FTP, FTPS and WebDAV (optional)

SFTP is enabled out of the box. FTP, FTPS and WebDAV ship disabled. To turn one on, give its binding a non-zero port in /etc/sftpgo/sftpgo.json, then restart the service.

For example, to enable WebDAV on port 10080, set webdavd.bindings[0].port to 10080, open that port in the NSG, and run:

sudo systemctl restart sftpgo

The same user accounts, permissions and quotas apply across every protocol you enable.

Security notes

• Encrypt web traffic. The web admin serves plain HTTP on port 80. For production, put it behind your own TLS-terminating reverse proxy or an Azure Application Gateway with a certificate for your domain, and restrict port 80 in the NSG to trusted networks. A common approach is certbot with your-domain on a front-end proxy.
• Keep the HTTP server private. It listens on 127.0.0.1:8080 only and is never exposed directly. Only nginx on port 80 and the SFTP service on port 2022 face the network.
• Start with your own admin. The image ships with no administrator. You create the first admin on the first visit, so there are no shared or default credentials to rotate. Fresh SFTP host keys are generated per instance on first boot, so no host key identity is shared across deployments.
• Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. For questions about this SFTPGo image or help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch SFTPGo on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com