Host a secure SFTP server from your own application in a few lines of C#. A complete SSH-2 implementation with its own cryptography — bring your own authentication and storage.
using Rst.Ssh; using Rst.Ssh.Sftp; await using var server = SshServer.CreateBuilder() .Listen(22) .Configure(o => o.HostKeys.Add(hostKey)) .UsePasswordAuthentication((user, pw) => user == "demo" && pw == "demo") .AddSftp(sftp => sftp.FileSystemFactory = s => ValueTask.FromResult<ISftpFileSystem>( new LocalFileSystem($"/srv/sftp/{s.User!.Identity!.Name}"))) .Build(); await server.StartAsync(); // Your app answers "is this allowed?" — the library does the rest.
In the spirit of an embeddable file server: you don't configure a separate service — you add a NuGet reference and run the server inside your own process. Authentication, storage and policy are plain C# callbacks, so the SFTP endpoint fits your existing identity system and data, wherever it lives.
Runs in-process in your ASP.NET, worker or desktop app. No external SSH daemon, no shell accounts.
Transport, key exchange and host keys built on the .NET BCL plus a self-contained Curve25519/Ed25519 implementation. No third-party crypto.
Implement ISftpFileSystem over local disk, object storage, a database or anything else. A local-directory backend ships in the box.
Password and public-key auth via callbacks or ISshAuthenticator. Multi-factor, attempt limits and login timeouts included.
Connection and SFTP events (with veto) plus an ASP.NET-style pipeline to log, throttle or block operations.
AES-GCM/CTR ciphers, strict KEX (Terrapin mitigation), flow control in both directions and rekeying.
Tested against OpenSSH 9.6 (ssh and sftp) across every combination of the algorithms below.
Start minimal, then layer on public keys, per-user file systems and event hooks — all in ordinary C#.
// The library verifies the signature; you decide if the key is allowed. builder.UsePublicKeyAuthentication((user, key) => authorized.Contains((user, key.Fingerprint))); // key.Algorithm → "ssh-ed25519", key.Blob, key.Fingerprint (SHA256:…)
// React to — or block — operations as they happen. sftp.OnUpload(e => { if (e.Path.EndsWith(".exe")) e.Reject("Executables are not allowed"); }); sftp.OnDownload(e => log.LogInformation("get {Path}", e.Path));
Full documentation and more samples are in the GitHub repository.
Licensed under the PolyForm Small Business License 1.0.0 with commercial licensing for larger organizations.
PolyForm Small Business is a source-available licence, not an OSI-approved open-source licence. The LICENSE file is binding; this page is a summary and not legal advice.
Over the small-business thresholds, or need a tailored commercial agreement? Get in touch and we'll sort out the right licence for your organization.
Prefer email: licensing@sftp-server.net