Ash: /Usr/Libexec/Sftp-Server: Not Found | Fast Fixes

What The Ash /Usr/Libexec/Sftp-Server Not Found Message Really Means

When your copy command fails with the line Ash: /Usr/Libexec/Sftp-Server: Not Found, that text comes from the ash shell running on the remote device. Many routers, access points, and embedded boards ship BusyBox with ash as the default shell. When your client runs scp or tries to open an SFTP session, it tells the server to start /usr/libexec/sftp-server. The shell tries to launch that program, cannot find it on disk, and prints the error before closing the session.

This situation often happens when a modern desktop or laptop with OpenSSH 9.0 or newer connects to an older firmware image. Newer OpenSSH releases make scp use the SFTP protocol by default instead of the older scp protocol, and that change expects a working sftp-server helper on the device. If that helper is missing, built under another path, or not wired into the SSH configuration, the ash shell reports a missing file and the transfer stops.

In plain terms, the message means the client asked the remote host to start an SFTP helper that either does not exist or lives in a different directory. The fix is to install the missing binary, point the SSH daemon at the correct path, or tell the client to fall back to the classic scp mode that does not need SFTP on the device.

Fixing The Ash /Usr/Libexec/Sftp-Server Not Found Error On Openwrt And Similar Devices

On OpenWrt, many UniFi access points, and small single board computers, SSH is often handled by Dropbear or a trimmed OpenSSH build. Those builds sometimes omit the SFTP helper to save flash space, so the path /usr/libexec/sftp-server simply does not exist. That is why the ash shell prints the full error and then closes the connection when scp or an SFTP client tries to start that helper.

The most direct way to restore file transfer on many of these devices is to install a package that contains sftp-server or a full OpenSSH server that includes it.

• Install an SFTP package — On systems that use opkg, such as OpenWrt or Onion Omega boards, run a command like opkg update && opkg install openssh-sftp-server over an existing SSH shell session. That command places the helper binary in the correct directory or in a related one so the SSH daemon can start it for SFTP traffic.
• Install full OpenSSH server — Some images ship only Dropbear. Switching to the OpenSSH server package often brings in the standard sftp-server binary under /usr/libexec/openssh or a similar location and gives you more room to tune file transfer behaviour.
• Restart the SSH service — After adding packages, restart the SSH daemon or reboot the device so it picks up the new binary and path. A quick test with sftp user@host from another machine confirms whether the change fixed the issue.

If the board has very little flash and you cannot spare the space for new packages, you can still move files by forcing the client to use the older scp protocol so the server does not need any SFTP helper at all. That change happens on the client side only and does not require extra storage on the embedded device.

Adjusting Scp On Newer Openssh Clients When Sftp Is Missing

OpenSSH 9.0 and later versions make scp tunnel the SFTP protocol for better safety. Older embedded devices that run Dropbear or very old OpenSSH releases often do not ship an SFTP implementation, yet they still understand the classic scp protocol. This mismatch between a modern client and a lean server is what produces the ash error when the client tries to launch /usr/libexec/sftp-server on the remote device.

You can work around that gap by telling your desktop or laptop to stick with the legacy scp protocol when it talks to that host, while leaving other hosts on the newer mode.

• Use scp -O for single transfers — Run scp -O file user@host:/path instead of a plain scp call. The -O flag keeps the client in classic scp mode, which does not ask the remote side to start an SFTP helper, so the ash error disappears and the copy completes.
• Create a host entry in ssh config — If you often copy to the same device, add a section in your ~/.ssh/config file with a host pattern, the hostname or IP, and any options your setup needs. You can then define an alias or wrapper script that runs scp -O for that host so you do not have to remember the flag each time.
• Use sftp directly when available — When the device eventually gains an SFTP helper, skip scp and use sftp user@host. That avoids the ash message, works smoothly with modern OpenSSH releases, and makes it easier to resume or manage multiple transfers.

This approach keeps changes on your side of the connection. It is handy when you do not control the remote firmware, when the device runs a vendor image, or when you want to avoid changing packages on an access point or router that already runs close to its storage limit.

Checking Sshd Subsystem Paths For Sftp-Server

Sometimes the line ash: /usr/libexec/sftp-server: not found does not mean SFTP is completely absent. The binary may live under a slightly different path while the SSH daemon still points at the old one. That often happens when a configuration file is copied from another Linux distribution that uses a different directory layout for OpenSSH helpers.

On a typical Linux server that runs OpenSSH, the SFTP helper lives in a directory such as /usr/lib/ssh/sftp-server or /usr/libexec/openssh/sftp-server. The daemon configuration file, usually /etc/ssh/sshd_config, contains a line that declares an SFTP subsystem, for example:

Subsystem   sftp   /usr/libexec/sftp-server

When that path does not match the real binary, the shell prints the not found message and SFTP sessions fail. The fix is to point this line at the correct directory and reload the daemon so new connections use the updated path.

• Locate the actual sftp-server path — Run which sftp-server or find / -name sftp-server 2>/dev/null over SSH to see where the binary lives. Many distributions place it in an openssh subdirectory rather than directly under /usr/libexec.
• Edit sshd_config with care — Open /etc/ssh/sshd_config with a text editor, look for the line that starts with Subsystem sftp, and change the path so it matches the directory you found. Keep a second root shell open while you reload the service so you can revert if the daemon refuses new connections.
• Restart the SSH service — Use the init system on the device, such as systemctl restart sshd or /etc/init.d/sshd restart, then test an SFTP login from another machine. If the path is correct, the ash error should disappear and your client should reach an SFTP prompt.

On very small router images that rely on Dropbear, you might not see an sshd_config file at all. In that case you cannot change the subsystem path, so you either install an extra SFTP package if the image allows it or keep using scp with the legacy protocol flag on the client.

Ash /Usr/Libexec/Sftp-Server Not Found Fixes By System Type

Because this error shows up on many device classes, it helps to line up common cases and the matching fix. The pattern stays the same: either add an SFTP helper on the remote side or make the client talk in a way the older firmware understands. The table below gives a quick cheat sheet for frequent setups.

Remote System	Typical Cause	Preferred Fix
OpenWrt Router With Dropbear	No SFTP helper package installed	Install openssh-sftp-server or use scp -O
Embedded Board With Custom Busybox Image	SFTP stripped to save flash space	Add OpenSSH server or keep scp in legacy mode
Standard Linux Server	Wrong Subsystem path in sshd_config	Adjust Subsystem line and restart sshd
Managed Device You Cannot Change	Firmware lacks SFTP helper and config access	Use scp -O or scp from an older client

This set of patterns covers most day to day situations. Once you know which side of the connection you can change, you can choose the fix that matches your access level and tolerance for firmware changes.

Practical Steps To Diagnose Ash: /Usr/Libexec/Sftp-Server: Not Found

When you see the exact message Ash: /Usr/Libexec/Sftp-Server: Not Found in a terminal window or in a file transfer tool, it helps to run a short series of checks instead of guessing. These steps show whether the problem comes from a missing binary, a wrong path, or a protocol mismatch between client and server.

• Confirm which side prints the message — Enable verbose mode on your client with scp -v or sftp -v and watch whether the error text shows up as remote output. That tells you the message comes from the device, not from your desktop.
• Test a plain SSH shell — Run ssh user@host and confirm that you can open a shell without any errors. If even basic login fails, fix general connectivity first, then return to file transfer.
• Search for an sftp-server binary — Once you have a shell on the device, run a quick search for sftp-server. No match points to a missing package. A match under a different directory points to an sshd_config mismatch.
• Try scp with -O — If you can log in and see a prompt, but transfers still fail, test scp -O. If this makes the error disappear, the device has no SFTP feature and you either keep that flag in place or add an SFTP helper later.
• Review logs when possible — On larger Linux machines with system log access, check /var/log/auth.log or the system journal for messages about SFTP subsystem failures. These lines often echo the wrong path and make the fix clear.

By walking through these checks in order, you narrow down the root cause step by step. That approach beats random tweaks and reduces time spent chasing guesses that do not match the actual setup.

When To Change Firmware Versus Client Settings

The final question is where to place the fix. In many home or lab setups you control both sides of the connection, yet only one side is easy to change. Flipping a flag on your laptop takes seconds. Reflashing a router or rebuilding a custom image takes more work and carries a real risk of locking yourself out.

For a personal router or small board that you own, adding an SFTP helper or a full OpenSSH server gives you long term flexibility. You gain native SFTP file transfer, clearer logging, and modern cipher choices, while still being able to copy files with scp when you want a quick command.

For managed hardware in a rack, or for loaner devices where you cannot touch the firmware, it is safer to adjust only the client. Keep a small note next to that host entry that says scp -O is required, and stick with classic scp until the vendor ships firmware with SFTP features.

Either way, once you know why ash prints /usr/libexec/sftp-server: not found, the error stops feeling mysterious. You can choose a clean fix that fits your setup, keep transfers steady, and avoid surprises the next time you upgrade OpenSSH on your main machine.