Installation
This guide covers installing Buru SFTP Server on Windows using the .exe installer and completing the post-install configuration wizard. For a portable (xcopy) deployment that does not require installation, see Portable Mode. To upgrade an existing installation, see Upgrade.
Prerequisites
You need a supported version of Windows (Windows 10, Windows 11, or Windows Server 2012 R2+) and administrator privileges on the machine. The SFTP port (default 22) and Web Administration port (default 8880) must not already be in use by another application. Both ports are configurable during the installation wizard.
Service account
When registering Buru SFTP as a Windows service, give some consideration to which account to use — it accesses files on behalf of SFTP users and hosts terminal shell sessions.
The default is the SYSTEM account, which has unrestricted access to the entire system. In production, use a dedicated Windows account with limited access rights.
2.9.6+ To use a virtual service account, set the username to NT Service\<service name>. For managed service accounts, the username must end with $, e.g. MyDomain\managed-user$.
2.0.0+ With Windows authentication, impersonation lets the server act as the authenticated Windows user directly, rather than the service account.
To spawn impersonated shell processes, the service account must hold the following privileges in the Local Security Policy (secpol.msc):
- Replace a process level token (
SeAssignPrimaryTokenPrivilege) - Adjust memory quotas for a process (
SeIncreaseQuotaPrivilege)
Prior to 2.18.4, Act as part of the operating system (SeTcbPrivilege) was required instead.
To grant the privileges:
- Run Local Security Policy (
secpol.msc). - Navigate to Local Policies → User Rights Assignment.
- Open each privilege, click Add User or Group, and add the Buru SFTP service account.
Install Buru SFTP Server
Download the installer for your platform (64-bit or 32-bit) and run it. Accept the license agreement and choose an installation directory.
After the files are copied, the post-install wizard guides you through the remaining setup.
Select server edition
Choose your license type:
- Professional PRO — for business use, including development, staging, and production. Requires a paid per-machine license from rebex.net.
- Free (non-commercial) — for personal, non-profit, or academic use. Cannot be used commercially.
- Trial — fully functional for 30 days. The server shuts down when the trial expires.
See Licensing for details.
Register SSH/SFTP server as a Windows service
Optionally register the server as a Windows service. You can do this later with burusftp svc install.
Choose the Windows account the service will run under. This account accesses files and folders on behalf of SFTP users — shell processes during terminal sessions also run under it.
SSH/SFTP endpoint configuration
Set the addresses and ports the SSH/SFTP server will listen on.
- SSH/SFTP Port: Default is
22.
The OpenSSH SSH Server (sshd) Windows service is often running and already occupies port 22 — disable it first if you intend to use the default.
- Local addresses: Defaults to
0.0.0.0(all IPv4 interfaces) and::(all IPv6 interfaces). A hostname can also be specified and is resolved to an IP address at service startup.
Register Web Administration as a Windows service
Web Administration is an optional component that provides a web UI for managing the server — an alternative to the CLI. Optionally register it as a Windows service here, or do it later with burusftpwa svc install.
Choose the Windows account the service will run under. It must have read and write access to the configuration folder.
Web Administration endpoint configuration
Configure the Web Administration endpoint.
- Web Admin Port: Default is
8880(HTTP). Since this is a non-standard port, include it in the URL — e.g.http://localhost:8880/.
HTTPS (TLS) can be configured later — see Secure Web Administration with HTTPS.
- Local addresses: Defaults to
localhost— the panel is only accessible from the local machine.
Add user
Set up the first SFTP user with password authentication.
- Username and Password — credentials for SFTP and optionally Web Administration.
- Web Administration access — tick to grant this user access to the Web Administration panel.
- SFTP Root directory — the directory on the Windows file system the user can access over SFTP. Without it, the user has no SFTP file access.
Public key authentication can be configured later — see User Management.
Post-installation tasks
Wait for the status to show OK, then click Next. If any step fails, see Troubleshooting. Click Finish.
Next steps
With the default settings, the server is accessible via SFTP at this point.
Open Web Administration at the address configured earlier (default: http://localhost:8880/) and log in with the credentials you created. If you skipped user creation, see Manage Users (CLI).
Before exposing the server to external traffic, review the Server Hardening guide.
Make sure the Windows firewall (and any network firewalls) allows inbound traffic on the ports the server is using. The default ports are:
| Port | Protocol |
|---|---|
22 | SSH/SFTP/SCP |
21 | Explicit FTP/FTPS |
990 | Implicit FTPS |
49152–65535 | FTP passive mode data channel |
8880 | Web Administration — only required for remote access |