I have actually been able to separate the external sftp-server from sshd, and connect it instead to stunnel. The sftp client binary can also be instructed to use something other than the ssh client to establish connectivity.

A simpler invocation could run it through (unencrypted) inetd/socket activation.

SELINUX really throws fits of hysteria when running this, however.

  $ cat sftp-tls.sh
  #!/bin/sh
  exec nc --ssl server 52345


  $ sftp -S ./sftp-tls.sh bogus
  Connected to bogus.
  sftp> cd /nobody
  sftp> get sftp-tls
  Fetching /nobody/sftp-tls to sftp-tls
  /nobody/sftp-tls       100%   15     8.9KB/s   00:00    
  sftp> quit


  # cat /etc/stunnel/sftp-ssl.conf 
  #GLOBAL####
 
  ;sslVersion =     TLSv1.2
  TIMEOUTidle =     6000
  renegotiation     =     no
           FIPS     =     no
        options     =     NO_SSLv2
        options     =     NO_SSLv3
        options     =     SINGLE_DH_USE
        options     =     SINGLE_ECDH_USE
        options     =     CIPHER_SERVER_PREFERENCE
         syslog     =     yes
          debug     =     debug
        setuid      =     nobody
        setgid      =     nobody
  #     chroot      =     /var/empty/stunnel
 
        libwrap     =     no
        service     =     sftp-ssl
  ; cd /var/empty; mkdir -p stunnel/etc; cd stunnel/etc;
  ; echo 'sftp-ssl: ALL EXCEPT localhost' >> hosts.deny;
  ; chcon -t stunnel_etc_t hosts.deny
 
  ; https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
 
 ciphers=ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:RSA+AESGCM:!aNULL:!MD5:!DSS

          curve     =     secp521r1
 
  #CREDENTIALS####
 
  #      verify     =     4
           cert     =     /etc/stunnel/sftp-ssl.pem
 
  #ROLE####
 
           exec     =     /usr/libexec/openssh/sftp-server
  #     execargs=   sftp-server -d /home/nobody
  #     execargs=   sftp-server -l DEBUG3

Don't forget some of your other options, such as piping across ssh commands, which is specifically very useful when piping tar output[1]. Piping tar commands traditionally was useful because it dealt better with some file types than scp did (devices, sockets, named pipes, tar is better overall at dealing with them, or was in the past). The other benefit is that after you realize you're just putting a sequence of commands into place to be run remotely, you start realizing you can do other things prior to the tar command if you need...

Rsync's ssh support is generally good, so might be about equivalent, but it's not always handy.

1: https://www.cyberciti.biz/faq/howto-use-tar-command-through-...

I’ve been using Linux and UNIX systems professionally for ~20 years and this is the first time I realised they were distinct protocols too.

I was definitely in the same boat. I guess I'll just progressively phase out my use of scp in favor of rsync.

Some servers, and some clients, only support one of them. I’ve run into servers without sftp and subsequently stopped using it, as scp always works.

Also rsync does not exist on windows, for instance git bash has only scp AFAIK.

A while ago I tried making windows' remote differential compression COM library work in a CLI utility like rsync.

https://docs.microsoft.com/en-us/previous-versions/windows/d...

You can install cygwin on windows. This will provide sftp, rsync and lftp which is awesome for doing rsync-like transfers on sftp-only chroot setups.

actually, sftp is a bit more scriptable than scp. You can pass sftp a "batchfile" of commands and control per-command whether their success should terminate the batch.

scp wins on brevity of commandline syntax

The script-ability of sftp is pretty awkward, it doesen't conform to how virtually every other tool works in terms of "command + args" in a shell scripting context, instead you need to pass it commands through a pipeline, don't love it.

Would be nice to be able to just type sftp user@domain:/file and have it do the right thing.

Oh, that means you have to open a pipe to the process if you want to control it from another programming language? That would be a bit harder to leverage for automation (though I guess it's just a matter of writing a few helper functions, or you could always use bash and redirections if the language is ill-suited to pipes).

Add lftp on top of sftp and you get extensive scriptability. Working public anonymous demo: [1]

[1] - https://tinyvpn.org/sftp/#lftp