SFTP
The workhorse of self-hosted storage: a file server over SSH, on every NAS and every Linux box.
Live-tested Verified against a live server
What Mountit does with it
- Mount
- Read and write, in Finder
- Offline cache
- Metadata cache, read-ahead and write-back — the same volume stack as every other service
- Encryption layer
- Available on this connection: client-side, rclone-compatible crypt over the data before it leaves your Mac
- Editions
- Both. Either edition mounts it through File Provider, so it appears in Finder — and, on Standard, in the Files app on iPad and Vision Pro
The engineering ledger lists SFTP among the services run against a
real server. Which of those two things it says is read out of docs/BACKEND-COVERAGE.md in the app repository when this site is
built, not typed here — so the level above moves when the ledger does, and the
build stops rather than leave the paragraph above it saying something else.
The conformance record
Blocked by a finding. A lane ran and 16 findings stand between this service and a clean record. They are the return on running the corpus, and they are published rather than filtered. Every service’s standing, side by side.
Being mounted once is the floor. The conformance harness runs the same
corpus of assertions at every backend — must for the contract the
volume layer relies on, should for a well-behaved server, and probe for observations that become capability data — and commits
the verdicts as a file. These numbers are read out of that file.
A failure here is a finding about this protocol, not a broken test. They are published rather than filtered because a page that showed only the green ones would be worth nothing.
| Lane | Run | Must | Should | Probe |
|---|---|---|---|---|
| openssh-sftp | 2026-09-01 | 49 passed, 16 failed | 23 passed, 5 failed | 21 passed, 6 failed, 3 skipped |
- openssh-sftp — 123 assertions. 16 assertions tagged
mustfailed. 2 capabilities the backend claimed were contradicted by what the server actually did. On the harness's own rule — nomustfailure and no capability disproved — this lane does not by itself promote the service.
Preset endpoints
These are the SSH daemon wearing a product name. The picker fills in the endpoint; what it cannot do is switch the service on, so each note names the admin screen that does.
| Provider | Endpoint | You paste | Notes |
|---|---|---|---|
| Hetzner Storage Box | sftp://{username}.your-storagebox.de:23 | Box username | Port 23 is the extended-SSH port (SFTP, rsync, Borg); port 22 also serves SFTP. Subaccounts use u123456-sub1.your-storagebox.de. docsfor Hetzner Storage Box ↗ |
| Synology (SFTP) | sftp://{host} | Server | Enable the SFTP service under Control Panel > File Services > FTP > SFTP first. docsfor Synology (SFTP) ↗ |
| QNAP (SFTP) | sftp://{host} | Server | SFTP rides the SSH service: allow SSH under Control Panel > Network & File Services > Telnet/SSH. Only administrator accounts may sign in. docsfor QNAP (SFTP) ↗ |
| TrueNAS (SFTP) | sftp://{host} | Server | SFTP is the SSH service, enabled under System Settings > Services. It does not chroot, so scope the account's dataset permissions. docsfor TrueNAS (SFTP) ↗ |
| OpenMediaVault (SFTP) | sftp://{host} | Server | SFTP rides the SSH service under Services > SSH; the account must be in the _ssh group. docsfor OpenMediaVault (SFTP) ↗ |
This table is not written on this page. It is generated from the preset list compiled into the app, and the build fails if the two disagree — which is the only way a page of endpoints stays worth trusting.
SFTP questions
Can Mountit mount SFTP?
Yes — SFTP is one of the 38 services selectable in the app. It mounts read-write, with the same cache, read-ahead and write-back as every other service.
What we will not do is claim it works before it does: this page carries the ledger’s evidence level for SFTP, and it changes the day the evidence does.
Which providers does the SFTP preset list cover?
Hetzner Storage Box, Synology (SFTP), QNAP (SFTP), TrueNAS (SFTP) and OpenMediaVault (SFTP). Anything else that speaks SFTP works too — you paste the endpoint yourself, and the preset only saves you finding it.
That list is not typed on this page. It is generated from the 47 presets compiled into the app, and the build fails if the two ever disagree — which is the only reason it is safe to publish endpoints at all.
Which edition do I need?
Either — this service is in both editions. The difference is the surrounding app, not the protocol: Mountit Pro is the unsandboxed build with the block protocols; Standard is the Mac App Store build, and on iPad and Vision Pro every service appears in the Files app. Both mount this service through File Provider.
Does it shell out to OpenSSH?
No. OpenDAL’s SFTP shells out to the ssh binary, which a sandboxed App Store app cannot do — so Mountit carries its own SFTP client on russh, and the same build runs in both editions.
What about host keys?
On first connect you see the server’s fingerprint and confirm it against what the administrator published. If it ever changes, Mountit refuses to connect rather than trusting silently — an unexpected host key change is indistinguishable from a machine-in-the-middle.