The safest common pattern for an SFTP-only account is a dedicated Unix group matched in sshd_config, a root-owned jail, and ForceCommand internal-sftp. Add explicit forwarding restrictions when the account does not need tunnels or agent, X11, or TCP forwarding. A chroot changes the session’s apparent filesystem root after authentication; it does not, by itself, disable shells, commands, or forwarding.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the restriction you actually need
“Restricted SSH access” can mean several different policies. Decide which one applies before creating the account:
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Policy | Session behavior | Typical controls |
|---|---|---|
| SFTP only | The client can transfer files but cannot obtain a shell or run an arbitrary SSH command. | ChrootDirectory plus ForceCommand internal-sftp; disable unneeded forwarding. |
| Interactive shell in a jail | The user receives a shell whose filesystem view is limited to the chroot. | ChrootDirectory, a functioning shell and libraries in the jail, required device nodes, and a carefully scoped account. |
| Jailed account with read-only data | The account can browse or download permitted files but cannot change them. | Root-owned or otherwise non-writable data directories, with write access omitted from the account’s effective permissions. |
| Jailed account with an upload area | The account can write only to a specific child directory. | Root-owned jail root and a writable child such as /upload. |
The rest of this guide uses the SFTP-only design because it provides the smallest attack surface and the fewest files to maintain. The shell-jail requirements are covered separately.
Build a dedicated account and group
Use a separate group for restricted accounts so that one Match Group rule can govern them consistently. The account should not be shared by people or automated jobs with different permissions.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- Create a group such as
sftpuserswith your operating system’s account-management tool. - Create the user
alice, set its home directory to the path it should see after the chroot, and add it tosftpusers. On systems where local policy requires it, assign a non-interactive shell. A non-interactive shell is an additional safeguard, not a replacement forForceCommand. - Set a password or install the required public key using your normal authentication policy. Test the account with an existing administrator account before closing that session.
The home-directory setting matters because, after authentication and chrooting, sshd changes the working directory to the user’s home directory. The configured home must therefore resolve to a directory inside the jail.
Create a jail with a root-owned boundary
Use a layout in which the jail itself is not writable by the restricted account:
/srv/
└── sftp/
└── alice/ (jail root, owned by root)
└── upload/ (writable child, owned or writable by alice)Every component from the real filesystem root through /srv/sftp/alice must be owned by root and must not be writable by the group or by others. OpenSSH checks this entire hierarchy when the session starts. If any component is unsafe, sshd refuses the session; the ownership rule also prevents a user from replacing a parent directory and changing what the jail points to.
Create the writable area below the boundary. For example, give alice write permission to /srv/sftp/alice/upload while leaving /srv/sftp/alice itself root-owned and non-writable. Do not make the jail root writable merely to make uploads convenient.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
On a typical Unix system, the following illustrates the intended end state; adapt group names, account tools, and modes to your platform:
sudo install -d -o root -g root -m 755 /srv/sftp
sudo install -d -o root -g root -m 755 /srv/sftp/alice
sudo install -d -o alice -g sftpusers -m 750 /srv/sftp/alice/uploadCheck each path component, not just the final directory. A permissive /srv or /srv/sftp can invalidate an otherwise correct-looking jail.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Apply the restriction with a Match block
Add a group-specific block to sshd_config:
Match Group sftpusers
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
AllowTcpForwarding no
AllowAgentForwarding no
X11Forwarding no
PermitTunnel no%u expands to the authenticated username, so alice is placed in /srv/sftp/alice. A fixed path can be appropriate for a single account, but the per-user pattern reduces the chance of accidentally sharing one user’s files with another.
Understand Match scope
Directives in a Match block apply only while that condition is active. The block continues until another Match line or the end of the file. Put the block after global directives and review any later blocks so that a subsequent condition does not change the intended behavior.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
What each directive does
ChrootDirectory /srv/sftp/%uchanges the session’s apparent root after authentication. It does not remove the ability to request a shell, execute a command, or use forwarding.ForceCommand internal-sftpreplaces the command supplied by the client for shell, command, and subsystem requests. The account is consequently an SFTP endpoint rather than a normal SSH shell account.AllowTcpForwarding noblocks SSH TCP forwarding, including local and remote forwarding.AllowAgentForwarding noprevents the session from forwarding an authentication agent.X11Forwarding nodisables X11 forwarding.PermitTunnel nodisables SSH tunnel devices.
Forwarding is a separate capability from filesystem confinement. Disable each feature your policy does not require and test those controls independently.
Why internal-sftp is usually the right subsystem
internal-sftp runs inside sshd. When used with ChrootDirectory, it does not need an external SFTP server binary, shared libraries, or other support files copied into the jail. That makes the jail smaller and avoids maintaining a second runtime environment.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →An external sftp-server has different operational requirements: the server executable and everything it needs must be available inside the chroot, with paths and libraries that match the host. Choose it only when you need behavior that your platform’s in-process server does not provide.
If you enable logging for an in-process SFTP session, some operating systems require a logging endpoint such as /dev/log inside the jail. Consult the platform’s OpenSSH configuration and logging behavior before relying on SFTP audit records.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Validate the configuration before reloading
Never experiment with the only administrative connection to a server. Keep an existing privileged session open, then use the platform’s sshd configuration test mode. On many OpenSSH installations, the check is:
sudo sshd -tIf your system uses a non-default configuration file or daemon path, pass the appropriate option for that installation. A successful syntax check does not prove that ownership, home-directory paths, authentication, or forwarding policy are correct; those require a live test.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Run the syntax test and correct every error before reloading.
- Reload the SSH service using the service manager for your operating system. Do not reboot as a substitute for checking the configuration.
- Keep the administrator session open until a new test connection has succeeded and the logs show the expected account and policy.
Test the account as an attacker would
Use a separate client or terminal and test both the intended workflow and the requests that must fail.
SFTP login and directory behavior
- Connect with an SFTP client, for example
sftp alice@host. - List the initial directory. It should expose the contents of the jail’s home path, not the host’s real
/srv,/etc, or filesystem root. - Upload a test file to
upload, download it, rename it if that is allowed, and remove it if the policy permits deletion. - Attempt to change to parent paths and absolute paths outside the jail. The client must remain within the chroot.
Shell and arbitrary-command requests
Try both an interactive request, ssh alice@host, and a command request, ssh alice@host 'id'. With ForceCommand internal-sftp, neither should provide a normal shell or execute the requested command; the session should instead be handled as SFTP or terminate according to the client’s behavior.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Forwarding requests
Attempt the forwarding modes your policy forbids, including a local or remote TCP forward, agent forwarding, X11 forwarding, and a tunnel request where applicable. Confirm rejection in the client output and in sshd’s authentication or connection logs. A successful file-transfer test does not demonstrate that forwarding is disabled.
Log review
Inspect the host’s SSH logs for the test account, chroot errors, permission failures, and forwarding attempts. If SFTP logging is enabled and records are missing, verify whether the platform expects /dev/log inside the jail.
If the user needs an interactive shell
A shell jail is substantially more complex than an SFTP-only jail. ChrootDirectory only changes the filesystem view; it does not populate that view with a usable operating system.
- Provide the user’s shell binary inside the jail.
- Provide every shared library and runtime file that the shell and required commands need.
- Create the basic device nodes required for standard input, output, error, null, zero, and terminal operation. The exact set and device-management method depend on the operating system.
- Provide a logging endpoint such as
/dev/logif the platform’s logging configuration requires it. - Restrict the command set deliberately. A shell with a text editor, scripting interpreter, compiler, or network utility may offer capabilities that defeat the intended policy even though the filesystem is chrooted.
Because each additional binary and device increases maintenance and attack surface, use an interactive jail only when the workflow genuinely requires it. For file exchange, internal-sftp avoids these support-file requirements.
Common failures and their fixes
| Symptom | Likely cause | Correction |
|---|---|---|
| “Bad ownership or modes for chroot directory” or an immediate disconnect | The jail or one of its parent components is not root-owned, or is writable by group or others. | Inspect every component of the path and make the boundary root-owned and non-writable. Put user-writeable content below it. |
| SFTP connects but starts in an unexpected directory | The account’s home directory does not resolve to the intended location inside the chroot. | Set the home path consistently with the jail and create that directory with the intended permissions. |
| Uploads fail while downloads work | The account has no write permission on the target child directory. | Grant write permission only on the designated child, not on the jail root. |
| An account still receives a shell or runs a supplied command | The user does not match the expected group, the block is shadowed by another Match block, or ForceCommand is absent. |
Verify group membership, effective configuration, block order, and the exact spelling of ForceCommand internal-sftp. |
| SFTP works but a forwarding attempt succeeds | Forwarding was left enabled globally or not disabled in the matching block. | Set the relevant forwarding directives to no and test TCP, agent, X11, and tunnel forwarding separately. |
| An interactive shell fails immediately | The chroot lacks the shell, libraries, device nodes, or logging endpoint it needs. | Either build the complete runtime deliberately or switch the account to internal-sftp. |
| Configuration changes appear ineffective | The daemon was not reloaded, the wrong configuration file was tested, or the user was tested through an existing connection. | Run the correct syntax test, reload the intended service, and create a fresh connection. |
Security decisions to document
Record the policy for each restricted account rather than treating every chroot as interchangeable:
Quick Recap
- Which group or account matches the
Matchblock? - What is the exact jail path and who owns every boundary component?
- Which child directories are writable, by whom, and for what purpose?
- Is the account SFTP-only, or does it require a shell?
- Are TCP, agent, X11, and tunnel forwarding each explicitly allowed or denied?
- What logging is required, and does the jail provide the platform’s required logging endpoint?
- When was a fresh-connection test last performed for SFTP, shell, arbitrary commands, path traversal, and forwarding?
Design comparison: what you gain and what you must maintain
| Design | Jail contents | Primary benefit | Main maintenance risk |
|---|---|---|---|
internal-sftp with a writable child |
Root-owned directory hierarchy and SFTP data directories | Smallest runtime and straightforward file-transfer policy | Incorrect ownership or an over-permissive child directory |
External sftp-server |
Server executable, libraries, and support files inside the jail | Useful when a specific external subsystem is required | Keeping binaries and libraries present and compatible |
| Interactive shell jail | Shell, libraries, commands, device nodes, and possibly logging facilities | Supports workflows that truly need shell programs | Larger attack surface and substantially more complex patching |
| Read-only SFTP jail | Root-owned data or directories without account write permission | Limits the account to retrieval and browsing | Accidentally granting write permission through group or inherited modes |
Operational checklist
- Create a dedicated account and group.
- Set the home directory so it maps to the intended location after chrooting.
- Make every jail path component root-owned and non-writable by group or others.
- Create writable data only in child directories.
- Add the group-specific
Matchblock withChrootDirectoryand, for SFTP-only access,ForceCommand internal-sftp. - Disable each forwarding feature that the account does not need.
- Run sshd’s configuration test mode, reload while retaining an administrator session, and make a fresh connection.
- Test SFTP paths and file operations, shell and command requests, all relevant forwarding modes, and the host logs.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
