SFTP & SSH Keys

Create an SFTP user under Sites → SFTP. Each user is restricted (chrooted) to the site's /web_root directory.

Creating an SFTP User

Go to Sites → SFTP → New SFTP User. Herne creates a system user (sftp_domainslug_XXXX) that is:

  • Chrooted to the site's web root — the user cannot browse outside the site container
  • Added to the sftpusers group which is configured in /etc/ssh/sshd_config

Create the SFTP user first, then add one or more SSH public keys from Sites → SSH Keys.

Permission Model

Herne separates the outer site container from the writable project directory.

  • The outer /var/www/{domain} path is kept suitable for SSH chroot rules.
  • The active project lives under /var/www/{domain}/web_root.
  • Runtime-writable Laravel paths such as storage/ and bootstrap/cache/ must be writable by the web runtime user.
  • Quick Install and runtime apply flows include writability checks before finalizing changes.

Connecting via SFTP

Use any SFTP client such as FileZilla, Transmit, or Cyberduck:

  • Host: your server IP or hostname
  • Port: 22
  • Protocol: SFTP
  • Username: shown in the SFTP users table
  • Authentication: SSH key

SSH Key Authentication

SSH Keys (Sites → SSH Keys) authorise key-based SFTP authentication — no password needed.

  1. Go to Sites → SSH Keys → Add SSH Key
  2. Paste your public key (format: ssh-ed25519 AAAA... comment or ssh-rsa AAAA...)
  3. The key is written to /etc/ssh/authorized_keys/{sftp_username}

SSH keys are stored per SFTP user at /etc/ssh/authorized_keys/{username}.

SSH Keys are per-site. Each SSH key added under a site is authorised for all SFTP users of that site.

Plan Limits

The number of SFTP users is limited by your plan (max_sftp_users).