Recommended Free Tools
For an SSH file-transfer account, the reliable pattern is an OpenSSH ChrootDirectory scoped to the account, paired with ForceCommand internal-sftp. The user sees the chroot as /, can write to a child directory, and does not receive a normal shell. The chroot directory and every parent component must be owned by root and must not be writable by group or others.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The procedure below uses /srv/sftp/alice as the jail and /srv/sftp/alice/data as the upload area. It follows the requirements documented in OpenSSH’s sshd_config(5) manual; adapt service names and paths to your distribution.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Choose the kind of restriction you actually need
A changed filesystem root, a permissions policy, and a service sandbox solve different problems. Decide which boundary you need before editing SSH configuration.
| Requirement | Use | What the process or user sees | Main trade-off |
|---|---|---|---|
| SFTP uploads and downloads without shell access | ChrootDirectory plus ForceCommand internal-sftp |
An SFTP view whose / is the jail |
Simple and does not require copied binaries or libraries |
| An interactive shell inside a reduced filesystem | Chroot plus a separately maintained mini-root | A shell and only the files you populate in the jail | Requires executables, libraries, devices, account databases, logging support, and ongoing patching |
| Access to selected paths while retaining the normal host view | Unix permissions, ownership, or ACLs | The regular filesystem root remains visible | This controls access to paths; it does not create a new filesystem root |
| Confinement for a daemon or systemd-managed process | systemd unit settings such as RootDirectory= and WorkingDirectory= |
The service process receives its configured root and working directory | This is a unit-level process boundary, not a replacement for an interactive-login policy |
For a dedicated upload account, the first row is normally the least complicated option. OpenSSH’s in-process SFTP server needs no copied shell, shared libraries, or other runtime files inside the chroot. The OpenSSH documentation describes this behavior in sshd_config.5.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Build an SFTP-only jail
1. Design the directory hierarchy
Keep the chroot root itself immutable to the account, then place writable content below it. A minimal layout is:
/srv/sftp/ root:root 755
/srv/sftp/alice/ root:root 755 # chroot root
/srv/sftp/alice/data/ alice:alice 700 # writable areaThe account can upload to /data from inside the SFTP session. It cannot replace or rename the chroot root because that directory belongs to root. Every component leading to the jail, including /srv where applicable, must satisfy OpenSSH’s ownership and mode checks. Inspect shared parent directories rather than changing their permissions blindly.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Create the directories with explicit ownership and modes
Run these commands as an administrator after the alice account exists:
sudo install -d -o root -g root -m 755 /srv/sftp
sudo install -d -o root -g root -m 755 /srv/sftp/alice
sudo install -d -o alice -g alice -m 700 /srv/sftp/alice/dataThe first command creates the common parent, the second creates the account’s chroot root, and the third creates the only directory that is writable by the account. If /srv/sftp already serves other users, preserve its existing policy while confirming that it is root-owned and not group- or other-writable.
Check the complete path before changing SSH:
namei -l /srv/sftp/alice
stat -c '%A %U:%G %n' /srv/sftp /srv/sftp/alice /srv/sftp/alice/datanamei -l shows each path component, which helps locate a writable or incorrectly owned parent. The stat output should show root:root for the jail components and alice:alice for the data directory.
3. Scope the SSH policy to the account
Add a user-specific block to /etc/ssh/sshd_config:
Match User alice
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
X11Forwarding no
AllowTcpForwarding no
PermitTunnel no%u expands to the authenticated username, so the same pattern can support separate root-owned directories such as /srv/sftp/bob when you use a group policy. OpenSSH’s manual documents token expansion and post-authentication behavior at the portable project’s sshd_config.5.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
ChrootDirectory changes the process-visible root after authentication. ForceCommand internal-sftp makes the account use the in-process SFTP server instead of receiving the user’s requested shell or another command. The forwarding directives remove three unrelated SSH features that an upload-only account normally does not need. If your deployment requires one of them, make that an explicit, reviewed exception rather than leaving it enabled accidentally.
For several accounts with identical rules, replace Match User alice with a suitable Match Group condition and keep each user’s path separate through %u. A user-specific block is easier to audit when only one account needs the restriction.
4. Validate the effective configuration before reloading
First check syntax:
sudo sshd -tA successful command produces no output. Then ask sshd to calculate the settings for the actual account and connection context:
sudo sshd -T -C user=alice,addr=127.0.0.1,host=localhost | egrep 'chrootdirectory|forcecommand|x11forwarding|allowtcpforwarding|permittunnel'The result should show the intended chroot path, the internal SFTP force command, and disabled forwarding options. The -C values should reflect the username, source address, and host name relevant to your configuration; conditional rules can produce different results for a different connection context.
Reload the SSH service with your distribution’s service manager only after both checks pass. Common systems use a unit named sshd or ssh; use the name installed on the target host. Keep an existing administrative session open while testing so a configuration mistake does not remove your recovery path.
5. Test a new SFTP session
Use a fresh connection because an already authenticated session is not retroactively moved into a chroot:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
sftp [email protected]
sftp> pwd
sftp> ls
sftp> put test-file.txt data/
sftp> ls data
sftp> get data/test-file.txtInside SFTP, pwd should report / or a path below it, and data should accept uploads while the jail root itself should not. The physical directory /srv/sftp/alice is invisible as such; it is the session’s /.
Also test an attempted shell connection:
ssh [email protected]The account must not obtain a normal interactive shell. Depending on the client and server configuration, the connection may be rejected or may end after the forced SFTP command starts. What matters is that no shell prompt or arbitrary command execution is available. Test downloads, uploads, directory listing, and an attempt to write directly to / so both the confinement and the intended write area are verified.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why the root-ownership rule matters
At session startup, sshd checks that every component of the ChrootDirectory path is a root-owned directory that is not writable by group or others. The documented default is none, meaning no chroot is applied. These checks prevent the account from modifying the directory that defines its own apparent root.
Ownership must also be stable after login. The OpenSSH manual warns that the hierarchy must be protected from modification by other processes, particularly processes outside the jail, because sshd cannot detect every unsafe arrangement. A separate job, deployment tool, or privileged application that changes ownership or modes can invalidate the assumption even when the initial setup was correct. The safety guidance appears in the sshd_config(5) manual.
Keep user data below the root-owned directory. Giving alice ownership of /srv/sftp/alice itself conflicts with the chroot requirement; giving her ownership of /srv/sftp/alice/data provides the write access without weakening the jail boundary.
Troubleshoot the common failure modes
sshd refuses to reload
Run sshd -t directly and correct the reported line before attempting another reload. Typical causes include a misspelled directive, an unmatched configuration value, or placing a setting outside the intended conditional block. Do not diagnose from an old session; validate the file and then open a new connection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
The connection authenticates but closes when the chroot starts
Inspect every path component with namei -l. A parent that is group-writable, other-writable, not a directory, or not owned by root violates the startup check. Correct only the affected component, then run sshd -t and try a new SFTP session. Ensure the configured path actually exists for the username produced by %u.
Listing works but uploads fail
In the example layout, / is intentionally not writable. Upload to /data and verify that the child directory is owned by alice with a mode that grants her write and search permission. If the application needs shared uploads, assign the child directory’s group and mode deliberately; never make the chroot root writable as a shortcut.
The account still receives a shell
Use sshd -T -C with the real user and connection context. If the output does not contain the intended ChrootDirectory and ForceCommand internal-sftp, the conditional rule is not being applied to that connection. Correct the matching condition or configuration placement, validate syntax, reload, and establish a fresh session. A shell that was opened before the change remains an old session.
Forwarding remains available
Check the effective values of X11Forwarding, AllowTcpForwarding, and PermitTunnel rather than assuming the text in the file is the active policy. If a connection context selects another rule, adjust the scoped block and retest. Disable only features the account does not require, and document any exception.
An external process changes the jail
Audit backup, deployment, synchronization, and maintenance jobs that touch the path. The chroot check occurs at session startup, but later changes can still undermine the intended hierarchy. Restrict which services can modify the directory and monitor ownership and mode changes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When an interactive shell inside the jail is unavoidable
An interactive chroot is substantially more work than an SFTP-only account. The shell executable and every shared library it needs must exist inside the jail. The environment also needs basic device nodes such as /dev/null, /dev/zero, standard streams, and a terminal device. Logging may require /dev/log. Programs that consult user and group databases need appropriate files inside the mini-root, and every utility you expect the user to run brings further dependencies.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
The OpenSSH documentation distinguishes this from the in-process SFTP case: SFTP needs no copied runtime environment, while an interactive session does. The details are described in the OpenSSH configuration manual.
A practical build sequence is:
- Create a dedicated root-owned hierarchy separate from the SFTP-only layout.
- Install only the shell, commands, libraries, device nodes, and account data that the workload requires.
- Provide a writable home or data directory below the protected chroot root.
- Test every intended command, terminal behavior, and logging path from a fresh session.
- Repeat the dependency and patching work whenever the host distribution updates the supplied binaries or libraries.
Do not choose an interactive chroot merely because the account needs to upload files. If the job is file transfer, internal-sftp avoids this packaging and maintenance burden.
When permissions or ACLs are a better fit
If the user must use the normal host environment but should reach only selected project directories, ordinary filesystem permissions or ACLs may be the correct control. They can grant read, write, or search permission on specific paths while leaving the account’s normal root unchanged. This is access control, not a filesystem jail: the user may still see other path names and system interfaces, subject to their permissions and the host’s broader policy.
Use this approach when command-line tools, compilers, or shared system files are genuinely required and the goal is to limit data access rather than to present a small SFTP namespace. Review parent-directory search permissions, inherited group access, and existing service accounts before granting an ACL. A permissions policy also does not remove SSH forwarding or shell capabilities; those must be controlled separately in sshd if they are not needed.
Use systemd settings for a daemon, not a login account
If the subject called a user is actually a daemon managed by systemd, configure the unit rather than an SSH login rule. The systemd.exec(5) documentation defines RootDirectory= for the service’s filesystem root and WorkingDirectory= for its working directory. A minimal unit fragment looks like:
[Service]
RootDirectory=/srv/mydaemon/root
WorkingDirectory=/var/lib/mydaemonInterpret the paths in the context of the service’s root and make sure the required directories and runtime files exist there. systemd also provides sandboxing directives that can further restrict filesystem exposure. Configure those controls at the unit level; they do not change what an interactive SSH user receives when logging in.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHardening beyond the chroot
- Keep the host patched. A chroot changes the filesystem view; it is not a complete kernel security boundary. Do not treat it as a substitute for timely operating-system and OpenSSH updates.
- Use least privilege. Give the account only the writable child directories and SSH features required for its job.
- Disable unused forwarding. X11 forwarding, TCP forwarding, and tunnel support are separate capabilities; turn them off for a transfer-only account.
- Account for MAC policy. SELinux or AppArmor can impose additional rules on sshd, the account, or the target path. A configuration that passes sshd’s own checks can still be denied by the host’s mandatory access-control policy.
- Evaluate mount flags per workload. ANSSI’s OpenSSH guidance discusses
nodev,noexec, andnosuidfor a dedicated file hierarchy. These are hardening choices to assess for the filesystem and application, not universal defaults; some legitimate workloads need execution or device behavior. - Protect the hierarchy from outside writers. Jobs running outside the jail can alter ownership, modes, or contents. Review which services can write to the parent path and limit that set.
- Do not assume every process is constrained. A chroot does not automatically solve separately configured SSH subsystems, privileged processes, or unrelated host-level access. Verify the effective policy for the exact account and service.
The ANSSI technical guidance shows the same broad pattern—a scoped Match rule, ForceCommand internal-sftp, and a per-user chroot path—while treating filesystem hardening options as deployment decisions. See ANSSI’s OpenSSH security technical guidance.
Operational checks before handing over the account
- Confirm that the account can authenticate using the intended method.
- Run
namei -lon the entire chroot path and verify root ownership and non-writable modes for every component. - Verify that the user-owned child directory exists and has the required capacity and permissions.
- Run
sshd -tand inspectsshd -T -Cfor the real username, address, and host context. - Reload the correct SSH service while retaining an administrative session.
- Test a new SFTP connection, upload, download, listing, and a write attempt at the jail root.
- Attempt an SSH shell and confirm that no normal shell is provided.
- Review SELinux or AppArmor decisions and any service or maintenance job that can modify the hierarchy.
This sequence distinguishes a filesystem-view restriction from ordinary permissions and from a daemon sandbox. For an upload-only account, the root-owned chroot plus a writable child directory and forced internal SFTP server provides the narrowest configuration with the fewest files to maintain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
