Why SFTP says permission denied
SFTP runs under the account you logged in with and it has no equivalent of sudo. Most files in /etc belong to root, so a normal account can read some of them and write none. This is correct behaviour and it is not something to fix by weakening permissions.
What not to do
Do not run chmod 777 on a configuration file, do not change the owner of /etc files to your account and do not enable root password login just for one edit. Some services refuse files with loose permissions, and every such change makes the server less safe long after the edit is finished.
Use sudoedit in a terminal
sudoedit copies the file to a temporary location, opens it in your editor under your own account and writes it back only after you save. The editor itself does not run as root.
sudoedit /etc/nginx/nginx.confUpload a copy, then install it
If you prefer a local editor, upload the file to your home directory and install it with sudo. Back up the original first, in a place that no configuration include reads. The install command sets the owner and mode, and on systems with SELinux restorecon sets the correct context. Check owner and mode of the original before you copy these values, because not every file uses root and 644.
stat -c '%U %G %a' /etc/nginx/nginx.conf
sudo cp -a /etc/nginx/nginx.conf /root/nginx.conf.bak
sudo install -o root -g root -m 644 ~/nginx.conf.new /etc/nginx/nginx.conf
sudo restorecon -v /etc/nginx/nginx.confValidate before applying
A syntactically wrong file can stop a service at its next restart. Run the check of the service in question before reloading it. When you change SSH settings, keep your current session open and test a new login from a second window.
sudo nginx -t
sudo sshd -t
sudo visudo -cf /etc/sudoers.d/exampleEditing with sudo in CH-J Server Manager
File Manager offers to open a file with sudo when the SSH account cannot read it, and warns that saving will need sudo. On saving, the data goes to the private temporary directory of the account and, after verification, sudo moves it into place while keeping the owner, permissions, ACL and SELinux context. An optional backup stores a copy of the original before replacing it. The password goes only to sudo on the server and is not stored on disk or in logs. If the sudo policy requires a terminal (requiretty), the app does not bypass it. The app does not validate the content of the file, so run the check of the service yourself.