SETUP AND FUNCTIONAL TESTING OF SFTP (SSH FTP) ON WINDOWS SERVER. SECURITY CONSIDERATIONS

The article addresses secure file transfer in corporate networks based on Windows Server. The study is motivated by the continued use of FTP, which can expose credentials and file contents to interception and unauthorized access. Its purpose is to develop and experimentally verify a methodology for deploying an SFTP server based on OpenSSH-Win64 in a Windows domain environment. The procedure includes preparing Active Directory security objects, configuring directories and NTFS permissions according to the principle of least privilege, setting up the sshd service and Windows Firewall, restricting user sessions to SFTP functionality, and connecting through WinSCP. The experiment was performed in an isolated Oracle VirtualBox environment with Windows Server 2022 and Windows 11. Functional testing confirmed domain authentication, file transfer, user isolation within the permitted directory, and correct handling of invalid credentials and network loss. Security-oriented scenarios included brute-force attempts, attempts to leave the permitted directory, attempts to obtain shell access, and attempts to access server-side log locations. The results show that the combined use of Active Directory, NTFS, and OpenSSH provides manageable access control. However, account lockout during password guessing can be abused for denial-of-service attacks and should be supplemented by source-based blocking. The study also discusses Windows-specific OpenSSH isolation limitations compared with the Linux chroot mechanism.