Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →SFTP problems become much easier to fix when you identify the failing layer first. SFTP runs over SSH, so a failed transfer can originate in the network path, SSH authentication, sshd_config, the SFTP subsystem, a chroot jail, or ordinary filesystem permissions. Test those layers in that order, validate configuration with sshd -t before restarting anything, and use server logs—or your VPS provider’s serial console when SSH is unavailable—to confirm each change.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Start by identifying which layer is failing
Do not treat every “SFTP connection failed” message as an SFTP configuration problem. A client can fail before it reaches the VPS, during SSH authentication, when the server starts the SFTP subsystem, or only after login when it tries to list, create, or modify a file. Each stage has different evidence and requires different access.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
| What you observe | Likely layer | First evidence to collect |
|---|---|---|
| The hostname does not resolve, or TCP connection to the SSH port times out or is refused | DNS, routing, provider firewall, security group, or host firewall | Address resolution, the configured SSH port, firewall rules, and provider status |
| The SSH banner appears but the client reports “Authentication failed” | Username, password, key selection, account policy, or Match/AllowUsers rules |
Verbose client output and the server authentication log |
| The client reports “Server refused our key” | Wrong account, missing or unreadable authorized-keys file, permissions, or unsupported key algorithm | Selected key, effective username, key-file path, and server-side rejection reason |
| Authentication succeeds but the SFTP session closes immediately | Malformed Subsystem or Match configuration, unavailable SFTP implementation, or chroot startup failure |
sshd -t, service status, and authentication/service logs |
| Login works but directory listing or upload returns “Permission denied” | Filesystem ownership, mode bits, ACL policy, or an unwritable path inside a chroot | The effective path seen by SFTP and ownership/modes on every path component |
This separation prevents a common mistake: changing key permissions when port 22 is blocked, or making a chroot writable when the real problem is an account restriction.
1. Prove that the VPS is reachable
Resolve the address and confirm the port
Use the exact hostname or IP address configured in the SFTP client. Confirm that the name resolves to the expected VPS address, then test the configured SSH port. Port 22 is common, but an administrator may have changed it. A timeout, refusal, or failure before an SSH banner means authentication and SFTP settings are not yet relevant.
Check the VPS provider’s firewall or security-group rule, the operating system’s host firewall, and routing. Permit the correct source address to the configured SSH port, and verify that the rule applies to the VPS instance you are using. Also check for a provider outage or a stopped instance before editing sshd_config.
Distinguish a timeout from an immediate refusal
- A timeout commonly indicates a dropped packet, an upstream firewall, a missing route, or a security rule that silently discards traffic.
- An immediate refusal usually means the address is reachable but no service is listening on that port, the SSH daemon is stopped, or a firewall is actively rejecting the connection.
- A successful SSH banner proves network reachability only; it does not prove that the requested account or SFTP subsystem can start.
If normal SSH access is already lost after a configuration change, do not repeatedly restart the service. Use the VPS provider’s out-of-band serial console or equivalent recovery console. AWS guidance specifically recommends serial-console access for boot, network, and SSH configuration recovery when ordinary access is impaired.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Reproduce the failure with useful diagnostics
Use verbose output from an OpenSSH client
Run one controlled test from a terminal rather than relying on a graphical client’s generic error:
sftp -vvv user@hostIf the server uses a nonstandard port, specify it explicitly:
sftp -vvv -P 2222 user@hostRead the output as a sequence. Identify whether it stops during name resolution, TCP connection, host-key negotiation, user authentication, subsystem startup, or the first file operation. Record the exact username, host, port, and private key used for the test; otherwise you may diagnose a different account than the one failing in the GUI.
Correlate the client message with server logs
On many Debian-family distributions, authentication events are written to /var/log/auth.log. On many RHEL-family distributions, the corresponding file is /var/log/secure. The system service journal may contain the same events or additional service-start failures. Review the log at the time of one reproduction, then match the account name and source address.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallA client message such as “permission denied” is ambiguous. A server log can show whether the key was rejected, the account was denied by policy, the chroot failed its ownership check, or a file operation lacked write permission. Microsoft’s troubleshooting guidance likewise directs administrators to inspect authentication and system logs rather than relying on a client’s summary.
3. Fix public-key authentication failures
Confirm the identity being authenticated
Check all four connection values before changing files:
- the VPS address or hostname;
- the SSH port;
- the intended Unix username; and
- the private key selected by the client.
A valid key for one account will be rejected when presented to another. GUI clients can silently select a different key than the one used by your terminal, so make the key choice explicit during testing.
Verify the authorized-keys location and contents
Ensure that the matching public key is present in the account’s authorized-keys file, or in the alternate location configured by the server. The path can be changed with the effective AuthorizedKeysFile setting, and a Match block can override global settings for a specific user or group.
Check that the file belongs to the target account (or the ownership policy required by the distribution), that the parent home directory is not writable by unrelated users, and that the file is protected with appropriate modes. OpenSSH may ignore a key when the file or its parent directory is considered insecure. Do not solve that by making the key file broadly writable.
Check account restrictions
Review AllowUsers, AllowGroups, and every applicable Match block in sshd_config. A user can have a correct key and still be denied because the account is outside an allowed group or because a conditional rule selects a different authentication policy. When rules overlap, determine which settings apply to the exact username, source address, and connection method you are testing.
Consider accepted key algorithms
Older OpenSSH deployments may not accept every modern or legacy key algorithm. If the server log says the key type is unsupported or the client offers no acceptable algorithm, compare the key type and the server’s accepted-algorithm policy. Prefer a key type supported by the current server and client rather than weakening policy globally. Microsoft documents “Authentication failed” and “Server refused our key” as symptoms that can involve key permissions, configuration, and accepted algorithms.
4. Validate sshd_config before restarting
Run the syntax check first
Before restarting or reloading SSH, run:
sudo sshd -tA clean return means the configuration syntax is valid. It does not prove that every referenced path exists, that the SFTP implementation is installed, that permissions are safe, or that the policy will allow the intended account. If the command prints an error, fix that exact line and run the check again. Keep an existing SSH session open while testing so a bad restart does not remove your only access.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check the SFTP subsystem declaration
The configuration must contain a working Subsystem sftp declaration. It may point to an installed external sftp-server program or use internal-sftp. A wrong path, a missing package, or a typo in a subsystem option can allow the daemon to start while causing SFTP sessions to fail.
For chrooted accounts, internal-sftp is often simpler because the subsystem runs inside the SSH daemon and does not require an external SFTP binary inside the jail. Red Hat documents this advantage for chroot configurations. If you use an external sftp-server, verify its path and any logging requirements for the target distribution.
Inspect the complete effective policy
Read the global settings together with every conditional Match block. A later rule can change the user’s shell, authentication methods, forwarding permissions, chroot path, or subsystem options. A malformed Match block can also produce syntax or session-handling errors. Validate after each edit instead of making several unverified changes at once.
5. Repair a chroot without weakening it
Why the jail root must not be writable
OpenSSH checks ownership and mode bits on the configured chroot path and its parent components. The chroot root must be owned by root and must not be writable by the SFTP user. If the jail itself is writable, the server can reject the session with an error such as fatal: bad ownership or modes for chroot directory component. SFTP Gateway summarizes the security reason directly: OpenSSH does not allow SFTP users write access to their chroot directory.
Use a root-owned jail and a writable child
A typical layout is a root-owned, non-writable jail containing a separate directory owned by the SFTP account or its upload group:
Rank #4
- Standard size: 4 pink server note pads, Each Book Comes with 50 bound order slips - that's 200 ticket sheets total! Check Pads Size 6.75 x 3.5 inch.
- Convenient Work: These guest check books for servers have a tear-free dotted line that is easy to rip off. You can give as a customer copy or keep for record keeping. We've provided extra rows on the back for additional note taking.Perfect For Restaurants, Lounges, Hotels, Cafes, And Waiters To Use.
- Record Important Information: These server note pads can record important information.Each ticket has a unique serial number printed at the top, dates, order details, number of guests, order amount, table numbers etc. They are lightweight, small and can fit most aprons. They can be used on-demand and can help decrease errors in orders, while improving work efficiency.
- High Quality: Sturdy, Not Drop Powder, It's Thick, You Can Write On The Back And Front Easily.Their whole page printing has clear handwriting and a reasonable layout. On the customer retention part of each guest check, "THANK YOU" on the back to make customers feel appreciated.
- Contact Us: We're confident that the quality of the server note pads will go beyond your expectation. If you experience an issue, contact us, we'll appreciate it to learn from your experience, and we'll make it better
sudo chown root:root /srv/sftp/alice
sudo chmod 755 /srv/sftp/alice
sudo mkdir -p /srv/sftp/alice/uploads
sudo chown alice:sftp-users /srv/sftp/alice/uploads
sudo chmod 750 /srv/sftp/alice/uploadsAdapt the path, group, and modes to your distribution and policy. The important relationship is that /srv/sftp/alice remains protected while /srv/sftp/alice/uploads is the location where the account is allowed to create or change files. Do not make the jail root writable as a quick fix.
Check every parent component
The server checks the chroot path and its components, not only the final directory. Inspect ownership and modes for the parent directories leading to the jail. A writable or incorrectly owned parent can trigger the same rejection even when the final directory looks correct. Correct the narrowest component that violates the policy, then retest.
Keep the configuration and filesystem consistent
If the account is configured with ChrootDirectory /srv/sftp/%u, the host path for user alice is /srv/sftp/alice. The user does not see that host path after login; the jail becomes /. Make sure the configured path exists before restarting and that the account can reach the intended child directory under the jail.
6. Use the path the SFTP user actually sees
Chrooting changes the namespace presented to the client. With ChrootDirectory /srv/sftp/%u, the host directory /srv/sftp/alice appears as / to alice. Therefore the writable host directory /srv/sftp/alice/uploads is opened as /uploads in an SFTP client—not as /srv/sftp/alice/uploads.
Set the client’s initial remote directory to /uploads when appropriate. You can also configure a start directory through the SFTP subsystem options documented for your OpenSSH version. If a client connects successfully but appears unable to find a directory, first check whether it is using a host filesystem path that is invisible inside the jail.
- Use
/to inspect the jail root. - Use
/uploadsfor the writable child in the example layout. - Do not grant write access to
/merely to make navigation easier.
7. Separate login permission from file permission
Authentication proves that the account may start a session; it does not grant write access everywhere. After a successful login, each operation is evaluated against Unix ownership, mode bits, and any additional filesystem access policy.
When listing fails
Check that the account has execute permission on each directory component and read permission where a listing is required. In a chroot, inspect the child directory’s ownership and modes on the host, then map that location to the path visible to the client.
When upload fails
Confirm that the destination directory—not the chroot root—is writable by the account or its group. A file may be uploadable to /uploads while the same operation correctly fails at /. Check free space and any filesystem policy that could deny creation, but do not broaden permissions until the server log identifies a permissions failure.
When overwrite or rename fails
Write permission on the directory controls creation, deletion, and renaming. Ownership of the existing file can also matter for changing its contents or metadata. Compare the requested operation with the permissions on both the directory and the target file rather than assuming that a successful upload proves every file operation is allowed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.8. Increase logging for one controlled reproduction
Raise SFTP or OpenSSH logging temporarily when normal messages do not distinguish the failure. Where supported, use a high diagnostic level such as DEBUG3, reproduce one failed login or transfer, collect the relevant entries, and return logging to a normal level immediately afterward. Extended debug logging can expose usernames, paths, and connection details and can generate substantial log volume.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsFor an external sftp-server, review the logging facility, log level, and any /dev/log requirement inside a chroot. Red Hat documents that an external subsystem may need access to the logging socket from inside the jail; internal-sftp changes that deployment requirement. On Linux, use the authentication log and service journal method supported by the selected subsystem and distribution.
On Windows OpenSSH, Microsoft recommends checking Event Viewer for relevant events and documents enabling SFTP logging and locating the resulting log. The exact interface and path differ from Linux, so do not apply Linux log-file assumptions to a Windows installation.
9. Recover through a serial console when SSH is unavailable
A broken SSH configuration can lock out both shell and SFTP access, making remote edits impossible. Use the VPS provider’s serial console or recovery console when available. This out-of-band path does not depend on the SSH daemon listening correctly.
- Open the provider console for the affected VPS and authenticate with an administrative account.
- Inspect the recent service and authentication logs to identify whether the daemon failed to start, rejected the configuration, or denied the account.
- Run
sshd -tagainst the active configuration and correct syntax, subsystem paths, orMatchrules. - Check chroot ownership and modes, key-file ownership and modes, and the existence of referenced directories.
- Restart or reload SSH only after the syntax check succeeds, then test from a separate client.
Keep a second administrative session or console open until the replacement connection has completed authentication and, for SFTP, a test listing and upload.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Choose the remedy that matches the evidence
| Remedy | Failure layer addressed | Access required | Security consideration | Validation |
|---|---|---|---|---|
| Correct firewall or security-group access to the SSH port | Network reachability | Provider control panel or host administrator | Limit the source range and expose only the intended port | TCP connection and SSH banner |
| Fix username, key selection, authorized-keys path, or key-file modes | Authentication | Normal SSH, another administrator, or serial console | Do not make private or authorized key files broadly writable | Verbose client output plus server authentication log |
Correct Subsystem sftp or Match settings |
Configuration and subsystem startup | Root or sudo, or serial console |
Changing authentication or chroot policy can widen access | sshd -t, service status, and one SFTP login |
| Make the chroot root safe and add a writable child directory | Chroot validation and uploads | Root or sudo |
Never make the jail root user-writable | Ownership/mode inspection, login, listing, and upload test |
| Adjust the destination directory’s ownership or mode | Post-authentication filesystem access | Directory administrator | Grant only the required account or group access | Server log and the specific file operation that failed |
| Use the provider serial console | Recovery when SSH is unreachable | Provider console privileges | Out-of-band access should be restricted and audited | Repair, then validate through a normal SSH/SFTP connection |
A repeatable end-to-end runbook
- Record the exact client error, username, address, port, and key.
- Confirm name resolution and TCP reachability to the configured SSH port.
- Run
sftp -vvvand note the stage at which the exchange stops. - Correlate that attempt with
/var/log/auth.log,/var/log/secure, or the service journal as appropriate. - For key failures, verify the account, authorized-key location, ownership, modes, account restrictions, and accepted algorithms.
- Run
sudo sshd -tbefore every restart or reload; repair any syntax error first. - Confirm a valid
Subsystem sftpand chooseinternal-sftpor an installed external subsystem consistently with the chroot design. - For chrooted users, make the jail and all parent components root-owned and non-writable, then provide a separate writable child.
- Translate host paths into the paths visible inside the jail before changing the client’s remote-directory setting.
- Raise logging only for a short reproduction, restore the normal level, and retain the evidence with the change record.
- Test the complete workflow: authenticate, list the intended directory, upload a small file, create or rename a file if required, and verify that access outside the jail remains blocked.
Prevent the next SFTP outage
- Keep a documented administrative access path, including the provider serial console, before editing SSH policy.
- Run
sshd -tas part of every configuration change and keep an existing session open during the first restart. - Document each account’s chroot host path and its corresponding in-jail path.
- Separate protected jail roots from writable upload directories.
- Record which authorized-key file, account restrictions, and key algorithms are in effect.
- Use a short, targeted debug window rather than leaving verbose authentication or SFTP logging enabled.
- After maintenance, test both an allowed upload and a deliberately disallowed path so that security boundaries are verified, not merely connectivity.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
