This question has many potential answers, ranging from loose at one end to paranoid at the other.
The two most important things to consider in almost all security related implementation questions are:
- How important is the data you're trying to protect?
- How motivated are your attackers likely to be?
In this case, if your attacker isn't a highly competent, motivated individual a reasonable solution would be:
- Encrypt the login credentials you're using for SFTP (username + password) with a passphrase and store them somewhere on the disk
- Rather than using cron, use some kind of long running daemon to do your periodic tasks. When you first start this process, read the encrypted credentials off the disk and enter the passphrase manually (in a shell)
- The decrypted credentials will remain in the memory of the process for its lifetime (you'll need to re enter the password for the credentials when the process is restarted). While it's possible, it's non trivial for an attacker to dump the memory for the entire process and trawl through it until they found the decrypted credentials.
While this solution is not impenetrable, it makes it at least difficult enough that an attacker managing to read arbitrary files off the disk wouldn't be able to gain access to unencrypted credentials, and even someone will full access to the server would have a reasonable degree of difficulty.