All Products
Search

This Product

    Bastionhost:Use SFTP for O&M

    Document Center

    Bastionhost:Use SFTP for O&M

    Last Updated:Jun 20, 2026

    Use a Secure File Transfer Protocol (SFTP) client to log on to a Bastionhost instance and transfer files to and from your assets. This topic uses Xftp 7 as an example to describe the SFTP O&M process.

    Transfer files using a client tool

    You can use a client tool, such as Xftp or WinSCP, to connect to a Bastionhost instance and transfer files. Bastionhost audits and records your operations.

    Prerequisites

    • You have imported assets and users to the Bastionhost instance and granted the users permissions on the assets. For more information, see Create a host, Manage users, and Authorize users to manage specified assets and asset accounts.

    • You have obtained the O&M address of the bastion host instance. You can find the O&M address in the Bastion Host Information section on the Overview page. For more information, see Overview of the Bastionhost console.概览

      Note

      Bastionhost provides a fixed O&M address as a domain name and uses dynamic IP addresses to prevent attacks. The IP address that is resolved from the O&M address may change. To prevent O&M failures caused by IP address changes, you must use the domain name provided by Bastionhost for O&M.

    • You have installed Xftp 7 on your on-premises machine.

    Procedure

    1. Open the Xftp tool and select .

    2. On the General tab, enter the O&M address, port number, username, and password of the Bastionhost, and then click OK.

      The default SSH port is 60022. If you need to change the Bastionhost's O&M port, see Configure a Bastionhost. For the connection settings, set Protocol to SFTP, Port to 60022, and Method to Password.

    3. If two-factor authentication is enabled, enter the verification code when prompted and click OK.

      For more information about how to configure two-factor authentication for a Bastionhost user, see Enable two-factor authentication.

    4. After you log on to the Bastionhost, view the list of authorized hosts and double-click the target host to access its directory.

      After you connect to the Bastionhost, the authorized hosts are displayed as folders in the root directory (/) of the right-side panel in Xftp. The folder names are in the ssh_root@Hostname_IPaddress:Port format. You may also see transcoding directories, such as !now_gb18030,next_BIG5. Double-click a host folder to access its directory.

      If you cannot access the host directory, try the following solutions:

      • Verify that the host account and password are saved in Bastionhost. If not, configure the host account. For more information, see Manage a host account.

      • Check whether directory names contain garbled characters. If they do, double-click the transcoding directory, ignore the error message that appears, and then right-click the directory and select Refresh to transcode the directory names.

      • Clear the client cache. In Xftp 7, select from the top menu bar. On the Security tab, clear the history.

      For more information about SFTP file transfer issues, see FAQ about SFTP file transfer.

      Note

      If the issue persists, join the DingTalk group (ID: 33797269) to contact product and technical experts for assistance.

    5. (Optional) Log on to the Bastionhost to view the audit records for file uploads and downloads. For more information, see Log on to the system and Search for and view sessions.

    Transfer files using the command line

    You can use the command line to connect to a Bastionhost instance and transfer files.

    Prerequisites

    You have the O&M address of your Bastionhost instance, which is available in the Bastion Host Information area on the Overview page. For more information, see Overview of the Bastionhost page.概览

    Note

    Bastionhost provides a fixed O&M address as a domain name and uses dynamic IP addresses to prevent attacks. The IP address that is resolved from the O&M address may change. To prevent O&M failures caused by IP address changes, you must use the domain name provided by Bastionhost for O&M.

    Procedure

    1. Open the command line and run the following SFTP command to connect to the Bastionhost instance:

      sftp -P <port> <username>@<bastionhostaddress>

      • <port>: Required. Replace <port> with the Bastionhost's SSH O&M port. The default port is 60022. If you need to change the Bastionhost's O&M port, see Configure a Bastionhost.

      • <username>: Required. Replace <username> with your Bastionhost username.

      • <bastionhostaddress>: Required. Replace <bastionhostaddress> with the Bastionhost's O&M address.

    2. Enter your Bastionhost password and press Enter.

    3. If two-factor authentication is enabled for the Bastionhost user, enter the verification code.

      For more information about how to configure two-factor authentication for a Bastionhost user, see Enable two-factor authentication.

    4. Run the ls command to list the available host directories.

      sftp> ls
!now_UTF-8,next_gb18030    ssh_root@doc_192.xxx:22    ssh_root@xxx_192.xxx:22

    5. Run the cd command to change to the target host's directory:

      cd <filename>

      <filename>: Required. Replace <filename> with the name of the target host directory.

    6. Run the get or put command to download or upload files.

      • Download a file

        get <remote-filename> <local-directory>

      • Upload a file

        put <local-filename> <remote-directory>

    7. (Optional) Log on to the Bastionhost to view the audit records for file uploads and downloads. For more information, see Log on to the system and Search for and view sessions.

    References