Connect an SFTP client to Bastionhost to transfer files between your local machine and managed assets, with all operations automatically audited. This topic covers two SFTP clients: SecureFX and FileZilla.
Prerequisites
Before you begin, ensure that you have:
Assets and users added to Bastionhost, with users authorized to access the assets. See Create a host, Manage users, and Authorize assets and asset accounts
The O&M address of your Bastionhost instance. Find it on the Overview page in the Bastion Host Information area. See Bastionhost page overview for details
Bastionhost assigns a fixed O&M address in domain name format and uses dynamic IP addresses to ensure security against attacks. Always use the domain name — not the resolved IP address — to avoid connection failures caused by IP changes.
SecureFX or FileZilla installed on your macOS machine
How it works
Both SecureFX and FileZilla route Secure File Transfer Protocol (SFTP) traffic through Bastionhost to your managed assets, so all file transfer activity is logged and auditable.
SecureFX connects directly to Bastionhost over SSH on port 60022. After authenticating, you browse assets from within the client.
FileZilla does not support SSH proxies natively. Instead, open a local SOCKS5 tunnel via the command line — connecting to Bastionhost on port 60022 — then point FileZilla through that tunnel directly to the asset's IP address on port 22.
Use SecureFX
Start SecureFX.
In the upper-left corner, click Connect. In the dialog box, click the
icon.
In the dialog box, enter the O&M address of the bastion host in the Hostname field, set the port to 60022, enter your Bastionhost username, and click OK. The default SSH port is 60022. To change the port, see Configure the bastion host port number.
Select the bastion host entry and click Connect.
In the Enter Secure Shell Password dialog box, enter the username and password of your Bastionhost account and click OK.
If two-factor authentication (2FA) is enabled for your Bastionhost user, enter the verification code and click OK. To configure 2FA, see Enable two-factor authentication.
After logging on, browse to the asset management page. Double-click a transcoding directory (ignore any error message that appears), then right-click the blank area and select Refresh to transcode the host directory name. If the asset directory is not accessible, try the following: For more troubleshooting guidance, see FAQ about SFTP-based file transmission.
Verify that the host account credentials are stored in Bastionhost. If not, add them. See Manage a host account.
Clear the SecureFX cache.
If the issue persists, join DingTalk group 33797269 for technical support.
(Optional) Log on to the Bastionhost console to review the audit records for file upload and download operations. See Log on to the console of a bastion host and Search for and view sessions.
Use FileZilla
FileZilla does not support SSH proxy configuration natively. The setup has two stages: open a SOCKS5 tunnel through Bastionhost, then connect FileZilla through that tunnel to the target asset.
Stage 1: Open a SOCKS5 tunnel
Open a terminal.
Run the following command to establish a SOCKS5 tunnel through Bastionhost:
Placeholder Description <bastionhost-username>Your Bastionhost account username <bastionhost-om-address>The O&M address of your Bastionhost instance (domain name format) ssh -T -N -D 127.0.0.1:1080 -oport=60022 <bastionhost-username>@<bastionhost-om-address>Replace the placeholders: The default SSH port is 60022. To change it, see Configure the bastion host port number.
Enter your Bastionhost account password and press Enter. Keep the terminal window open — closing it terminates the tunnel.
If two-factor authentication (2FA) is enabled for your Bastionhost user, enter the verification code. To configure 2FA, see Enable two-factor authentication.
Stage 2: Connect FileZilla through the tunnel
Start FileZilla and go to Settings. Under Generic proxy, select SOCKS5, enter
127.0.0.1in the Proxy host field, enter1080in the Proxy port field, and click OK.Open Site Manager and click New site. Fill in the following fields and click Connect: In the confirmation dialog box, click OK.
Field Value Host IP address of the target asset Port 22Logon Type Normal Username Host account username on the asset Password Host account password on the asset After the connection is established, transfer files between your local machine and the asset. All operations are audited through Bastionhost.
(Optional) Log on to the Bastionhost console to review the audit records for file upload and download operations. See Log on to the console of a bastion host and Search for and view sessions.
What's next
Review common issues and solutions for SFTP file transfer in FAQ about SFTP-based file transmission.