Set Up an SFTP Server on Android Using Termux (No Root)

Many Android users need a quick way to pull files from their phone without using cloud services or USB cables. An SFTP (SSH File Transfer Protocol) server gives you encrypted, password‑protected access over Wi‑Fi or a LAN, and you can reach the device from any desktop, laptop, or another Android phone.

Before You Start

• Android 7.0 or newer (Termux runs on most devices from Android 5.0 onward).
• At least 200 MB of free storage for Termux packages and log files.
• Wi‑Fi connection to the same local network as the client computer.
• A stable power source if you plan to keep the server running for hours.
• Optional: Termux:Boot app from F‑Droid if you want the server to start automatically after reboot.

Step 1 – Install Termux and Update Packages

1. Open the Google Play Store (or F‑Droid) and install Termux.
   • F‑Droid often has the most up‑to‑date build, but the Play Store version works equally well.
2. Launch Termux. The first launch will set up the basic environment.
3. Update the package repository and upgrade existing packages:

   pkg update && pkg upgrade -y

   This may take a few minutes.

Step 2 – Install OpenSSH (the engine behind SFTP)

1. In the Termux prompt, install the OpenSSH package:

   pkg install openssh

2. Verify the installation by checking the version:

   ssh -V

   You should see something like OpenSSH_8.9p1, OpenSSL 1.1.1k.

Step 3 – Create a Dedicated SFTP User

Running the SSH daemon as the default u0_aXXX Android user gives the server full access to your phone, which is risky. Instead, we create a restricted user that can only see a specific folder.

1. Create a new Unix‑style user called sftpuser:

   adduser sftpuser

   Termux will ask for a password and some optional details. Choose a strong password.
2. Create a directory that will be the root of the SFTP share, for example /data/data/com.termux/files/home/sftp_share:

   mkdir -p ~/sftp_share

3. Change ownership so that sftpuser can read/write inside the share:

   chown sftpuser:sftpuser ~/sftp_share

4. Optional – create a sub‑folder for each type of file you plan to store (e.g., photos, documents).

Step 4 – Configure the SSH Daemon for SFTP‑Only Access

The default sshd_config allows full shell access. We will edit it to limit the new user to SFTP and jail them to the share directory.

1. Open the configuration file with nano (install it if needed with pkg install nano):

   nano $PREFIX/etc/ssh/sshd_config

2. Locate the line that begins with #Subsystem sftp /data/data/com.termux/files/usr/libexec/sftp-server and uncomment it (remove the leading #):

   Subsystem sftp /data/data/com.termux/files/usr/libexec/sftp-server

3. At the end of the file, add a block that restricts sftpuser:

   Match User sftpuser
       ChrootDirectory %h/sftp_share
       ForceCommand internal-sftp
       X11Forwarding no
       AllowTcpForwarding no
       PasswordAuthentication yes

   Explanation:
   • ChrootDirectory confines the user to the sftp_share folder.
   • ForceCommand internal-sftp disables shell access.
   • Disabling X11 and TCP forwarding reduces attack surface.
4. Save the file (Ctrl+O, Enter) and exit (Ctrl+X).

Step 5 – Generate Host Keys (if they don’t exist)

OpenSSH needs a set of host keys to identify the server. The first time you start sshd, it will create them automatically, but you can also generate them manually.

ssh-keygen -A

This creates RSA, ECDSA, and ED25519 keys in $PREFIX/etc/ssh/.

Step 6 – Start the SSH Daemon

1. Start the service manually to test the configuration:

   sshd

   If you see no output, the daemon started successfully.
2. Find the IP address of your Android device (you’ll need it for the client):

   ip addr show wlan0

   Look for the line containing inet, e.g., 192.168.1.42/24. The part before the slash is your device’s IP.
3. From a PC on the same Wi‑Fi network, test the connection:

   ssh sftpuser@192.168.1.42

   You should be prompted for the password you set earlier. If you see a “Permission denied” error, double‑check the password and the sshd_config changes.

Step 7 – Connect with an SFTP Client

Any standard SFTP client works (FileZilla, WinSCP, Cyberduck, or the sftp command line).

1. Open your client and create a new site/connection.
   • Host: 192.168.1.42 (replace with your device’s IP)
   • Port: 22 (default SSH port)
   • Protocol: SFTP – SSH File Transfer Protocol
   • Logon Type: Normal
   • User: sftpuser
   • Password: the password you chose in Step 3.
2. Connect. The client should display the contents of sftp_share. You can now drag‑and‑drop files, create folders, or delete items.

Step 8 – Make the Server Start Automatically (Optional)

If you want the SFTP server to be available after a reboot without manually typing sshd, use the Termux:Boot add‑on.

1. Install Termux:Boot from F‑Droid.
2. Create a startup script in ~/.termux/boot (create the folder if it doesn’t exist):

   mkdir -p ~/.termux/boot
   cat > ~/.termux/boot/start-sftp.sh <<'EOF'
   #!/data/data/com.termux/files/usr/bin/sh
   sshd
   EOF
   chmod +x ~/.termux/boot/start-sftp.sh

3. Reboot the device. After the system boots, open Termux briefly to verify that ps aux | grep sshd shows the daemon running.

Step 9 – Secure the Server Further

Running a password‑based SFTP server is convenient, but key‑based authentication is more secure.

9.1 Generate an SSH key pair on the client

ssh-keygen -t ed25519 -C "android-sftp"

Accept the default file location (e.g., ~/.ssh/id_ed25519) and set a passphrase.

9.2 Copy the public key to the Android device

1. On the Android side, create the .ssh folder for sftpuser:

   mkdir -p /data/data/com.termux/files/home/.ssh

2. Append the public key to authorized_keys:

   echo "$(cat ~/.ssh/id_ed25519.pub)" >> /data/data/com.termux/files/home/.ssh/authorized_keys

3. Set proper permissions:

   chmod 600 /data/data/com.termux/files/home/.ssh/authorized_keys

9.3 Disable password authentication (optional but recommended)

Edit $PREFIX/etc/ssh/sshd_config again and change the line PasswordAuthentication yes to PasswordAuthentication no. Restart the daemon:

pkill sshd
sshd

Troubleshooting

• Port 22 is blocked by the device firewall. Android does not ship a firewall by default, but some OEM skins (e.g., Huawei, Xiaomi) include a network‑access control. Disable or allow port 22 in the OEM’s security settings.
• “Connection refused” error. Verify that sshd is running (ps | grep sshd) and that you are using the correct IP address. Wi‑Fi isolation on some routers prevents devices from seeing each other; disable AP‑isolation.
• “Permission denied (publickey,password)” despite correct password. Double‑check the Match User sftpuser block – a stray space or typo can cause the daemon to ignore the rule.
• File‑permission errors inside the SFTP share. The chroot directory (sftp_share) must be owned by root for OpenSSH to accept the chroot. In Termux, the closest equivalent is the user that started the daemon. If you get “Bad owner or permissions” when starting sshd, change ownership:

  chown root:root ~/sftp_share

  Then create a sub‑folder owned by sftpuser for read/write access:

  mkdir ~/sftp_share/incoming
  chown sftpuser:sftpuser ~/sftp_share/incoming

• Server stops after the screen locks. Termux processes are killed when the app is swiped away or when Android enters a deep‑sleep state. Use the termux-wake-lock command before starting sshd to keep the CPU awake:

  termux-wake-lock
  sshd

  Remember to release the lock later with termux-wake-unlock.

Advanced Options

Limit the SFTP user to a read‑only view

Replace the ForceCommand internal-sftp line with:

ForceCommand internal-sftp -u 022

Expose the server to the Internet (caution)

For remote access you can forward port 22 through your home router’s NAT. This involves setting up a port‑forward rule (e.g., external port 2222 → internal IP 192.168.1.42 port 22). Never expose the server without key‑based authentication and a strong firewall rule.

Use a custom port

Editing Port 22 in sshd_config to something like Port 2222 reduces automated scans. Remember to update your client configuration accordingly.

Cleaning Up

When you no longer need the SFTP server:

1. Stop the daemon: pkill sshd.
2. Remove the user and its home folder if you created one:

   deluser sftpuser
   rm -rf ~/sftp_share

3. Optionally uninstall OpenSSH to free space:

   pkg uninstall openssh

What You’ve Learned

By the end of this tutorial you should be able to:

• Install Termux and the OpenSSH package without rooting.
• Create a restricted SFTP user and a chrooted directory.
• Configure sshd_config for SFTP‑only access.
• Start the SSH daemon, connect from any client, and transfer files securely.
• Enable key‑based authentication, set up auto‑start, and troubleshoot common problems.

With a lightweight SFTP server on your phone you gain a flexible, encrypted file‑sharing method that works on any network, respects Android’s sandbox, and requires no special permissions beyond what Termux already provides.