SFTP Connectivity - SSH Key Authentication

ED25519 is the algorithm recommended by the Unix/infrastructure team. It provides stronger security than RSA with a shorter key length, and is supported by OpenSSH 8.0+.

ssh-keygen -t ed25519 -a 100

Example session (on SAP-DEV as devadm):

Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/devadm/.ssh/id_ed25519): /home/devadm/.ssh/ssh_key_uat
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/devadm/.ssh/ssh_key_uat.
Your public key has been saved in /home/devadm/.ssh/ssh_key_uat.pub.
The key fingerprint is:
SHA256:Z6iykBXNvtP84njBNILg1p3LZrxnGOhmwQ6+IYF/kDA devadm@SAP-DEV

Verify the generated key:

ssh-keygen -lf ~/.ssh/ssh_key_uat.pub

Expected output:

256 SHA256:Z6iykBXNvtP84njBNILg1p3LZrxnGOhmwQ6+IYF/kDA devadm@SAP-DEV (ED25519)

NOTE: Use -a 100 (key derivation rounds) to strengthen the key against brute-force attacks on the passphrase, if a passphrase is set.

After generation, send the public key file (*.pub) to the vendor contact, and request it be registered on the SFTP server for the corresponding environment and username.

Do not proceed to connection testing until the vendor confirms the key has been activated.

Before and after key deployment, verify that both private and public key fingerprints are identical:

# Private key fingerprint
ssh-keygen -lf ~/.ssh/id_acme-ssh_key-prod

# Public key fingerprint
ssh-keygen -lf ~/.ssh/id_acme-ssh_key-prod.pub

Both commands must return the same SHA256 fingerprint. A mismatch indicates a key file integrity problem.

Create a minimal test script for each environment. The -v flag enables verbose debug output, which is essential for diagnosing authentication failures.

UAT test script (run as devadm on SAP-DEV):

#!/usr/bin/bash
FTPUSR=ftpuser-uat@vendor-domain
FTPSRV=VENDOR-SFTP-UAT
FTPKEY="$HOME/.ssh/ssh_key_uat"
sftp -v -i $FTPKEY $FTPUSR@$FTPSRV

PRD test script (run as prdadm on SAP-PRD):

#!/usr/bin/bash
FTPUSR=ftpuser-prd@vendor-domain
FTPSRV=VENDOR-SFTP-PRD
FTPKEY="$HOME/.ssh/id_acme-ssh_key-prod"
sftp -v -i $FTPKEY $FTPUSR@$FTPSRV

Run the test with a timestamp to record when connectivity was validated:

date && ./test_ssh_key.sh

WARNING: This method is obsolete and not recommended for production use. It is retained here for historical reference only.

Initial connectivity tests were performed using sshpass before SSH key pairs were exchanged.

#!/usr/bin/bash
FTPUSR=ftpuser-uat@vendor-domain
FTPSRV=VENDOR-SFTP-UAT
FTPPAS=XXXXXXXXXXXXXXXXXXXX
LOG=$HOME/sftp-test.log

echo "$(date '+%d.%m.%Y - %H:%M:%S') => Attempting connection" >> $LOG
sshpass -p $FTPPAS sftp -v $FTPUSR@$FTPSRV << EOF >> $LOG 2>&1
EOF

Successful output (filtered):

Password authentication
Authenticated to VENDOR-SFTP-UAT (IP-UAT:22).
Connected to VENDOR-SFTP-UAT.