What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To set up SFTP on a Linux VPS, install the OpenSSH server, create a dedicated account, and add an sshd Match block that runs internal-sftp. For a locked-down transfer account, combine ForceCommand internal-sftp with ChrootDirectory, disable forwarding and TTY access, and make only a child directory writable. Validate the configuration with sshd -t and test from a second session before closing your administrative connection.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What SFTP is and what this setup changes
SFTP is the SSH File Transfer Protocol. In this arrangement it is not a second FTP daemon: the existing OpenSSH service provides encrypted remote-control and file-transfer operations, and the SFTP client connects through that SSH service. Canonical describes OpenSSH as providing “secure, encrypted, remote control and file transfer operations,” replacing older unencrypted tools.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters operationally. You install and maintain OpenSSH, authenticate with the same SSH mechanisms, and inspect the same service logs. An SFTP user can be a conventional Linux account with its normal home directory, or it can be restricted to a filesystem jail and prevented from starting a shell. The second option is useful for uploads, downloads, game-server assets, backups, and other transfers where the account should not administer the VPS.
The procedure below uses Ubuntu commands. Fedora, RHEL, Alpine, and other distributions use different package and service names, so confirm the equivalent OpenSSH package and service for your VPS image before applying commands.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose the account model before changing SSH
| Model | Shell access | Filesystem visibility | Setup and recovery | Best fit |
|---|---|---|---|---|
| Regular SFTP account | Unless separately restricted, the account can use its configured shell through SSH. | The user can see paths permitted by ordinary Unix ownership and permissions. | Simpler ownership and key-file placement; fewer chroot-specific failure modes. | Trusted users who need normal Linux access as well as file transfer. |
| Chrooted SFTP-only account | ForceCommand internal-sftp prevents a normal shell or requested command; PermitTTY no removes terminal allocation. |
ChrootDirectory makes the selected directory the session’s filesystem root. |
Requires every jail-path component to be root-owned and not writable by group or others. A writable child directory must be created. Permission errors require careful recovery. | Upload-only or transfer-only access where a user should not browse the rest of the VPS. |
A chroot is a filesystem boundary for the SFTP session, not a replacement for all host security controls. Keep the account’s Unix permissions narrow, use key authentication where practical, and retain an administrative account outside the restricted group.
Preserve an administrative path first
Do the work from an existing root or administrative SSH session and leave that session open. A typo in sshd_config, an ownership mistake, or an unsupported directive can prevent new logins. The open session is your recovery path.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Record the VPS distribution, image release, and installed OpenSSH version. Directives and service names can differ between releases.
- Confirm which account currently has administrative access and do not add it to the SFTP-only group.
- Identify the configuration file layout. Ubuntu commonly reads
/etc/ssh/sshd_configplus snippets in/etc/ssh/sshd_config.d/. - Keep a second terminal ready for testing, but do not close the first terminal until SFTP and SSH restriction tests succeed.
Install and start the OpenSSH server on Ubuntu
If the VPS image does not already provide the server package, install it and enable the service:
sudo apt update
sudo apt install openssh-server
sudo systemctl enable --now sshopenssh-server supplies the SSH daemon and the SFTP subsystem used by this guide. On another distribution, use that distribution’s package manager and service unit instead of copying the Ubuntu commands literally. If the service is already active, installing the package does not require replacing an existing configuration; inspect the current policy before adding a new block.
Create a dedicated SFTP group and account
A group-based rule lets you apply one policy to several transfer accounts later. The following creates a system group and an account named alice with a non-login shell:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
sudo groupadd --system sftpusers
sudo useradd --create-home --home-dir /srv/sftp/alice
--shell /usr/sbin/nologin --gid sftpusers alice
sudo passwd aliceOmit sudo passwd alice when the account must use keys only and your authentication policy has been configured accordingly. The /usr/sbin/nologin shell is an additional safeguard, but the SSH Match block below is what forces SFTP and rejects an interactive shell request. If you create more users, give each one a separate directory such as /srv/sftp/bob and keep the same group membership.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Build a chroot layout that OpenSSH will accept
With ChrootDirectory /srv/sftp/%u, the directory for the username becomes the jail root. OpenSSH checks every component of that path: /srv, /srv/sftp, and /srv/sftp/alice must be owned by root and must not be writable by the group or by other users. Do not make the jail root itself the upload directory.
sudo mkdir -p /srv/sftp/alice/files
sudo chown root:root /srv /srv/sftp /srv/sftp/alice
sudo chmod 755 /srv /srv/sftp /srv/sftp/alice
sudo chown alice:sftpusers /srv/sftp/alice/files
sudo chmod 700 /srv/sftp/alice/filesThe files directory is below the jail root, so alice can write there while the root of the jail remains protected. Inside an SFTP session, the user normally starts at the jail root and can change into files. A mode of 700 gives the account exclusive access to that directory; choose a different mode only when a documented collaboration requirement calls for it.
Check the entire path, not just the final directory, when diagnosing a rejection:
namei -l /srv/sftp/aliceThis displays ownership and modes for each component. A parent directory owned by the wrong user, or writable by group or others, can trigger “bad ownership or modes for chroot directory” even when /srv/sftp/alice looks correct.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Configure SSH keys without granting a shell
Public-key authentication is preferable for an automated or service account because it avoids placing a reusable password in scripts. On the client, create an Ed25519 key if you do not already have one:
ssh-keygen -t ed25519
ssh-copy-id [email protected]The key-copy command uses an SSH login to append the public key. If you intend to disable passwords, first confirm that a fresh connection works with the key. Also verify the server’s AuthorizedKeysFile location and ownership rules enforced by StrictModes.
A chroot introduces an important placement issue: the authorized-key file must remain readable before the daemon enters the jail, and the writable files directory must not be used to store it. Keep the key file outside the writable chroot or set an explicit AuthorizedKeysFile path that the installed OpenSSH version can read. Confirm the resulting path and permissions on your distribution before turning off password authentication. A key that exists only inside a user-writable jail is not a safe or reliable configuration.
Add an SFTP-only Match block
Create a dedicated snippet, for example /etc/ssh/sshd_config.d/sftp.conf, or append the block to the main configuration file:
Match Group sftpusers
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
DisableForwarding yes
PermitTTY no
PasswordAuthentication yesWhat each directive does
Match Group sftpusers: applies the following settings only to accounts in the dedicated group.ChrootDirectory /srv/sftp/%u: substitutes the login name for%u, so each user receives a separate jail.ForceCommand internal-sftp: runs SFTP in-process even if a client asks for a shell or supplies another command. It is specifically useful with a chroot because it does not need executable support files inside the jail.DisableForwarding yes: disables unrelated SSH forwarding features for matched accounts. Check the installed manual if this directive is unavailable in the VPS’s OpenSSH version.PermitTTY no: prevents allocation of an interactive terminal.PasswordAuthentication yes: permits passwords for this group only if the global policy allows them. Remove this line when the server is intentionally keys-only; a per-group line must not quietly override a security policy you meant to keep global.
internal-sftp is a subsystem implementation built into the daemon. You normally do not need to copy a separate SFTP binary, libraries, or device files into the jail. If your existing configuration has a conflicting Subsystem sftp line, inspect it rather than adding arbitrary alternatives; the selected subsystem and the forced command must be supported by the installed OpenSSH release.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Match changes how subsequent lines are interpreted. Do not put unrelated global directives after this block unless you begin another conditional section with Match all. Keeping the group-specific settings in a separate snippet reduces accidental scope errors.
Validate, reload, and test safely
Never reload an unvalidated SSH configuration. First run the daemon’s syntax check from the still-open administrative session:
sudo sshd -tNo output means the syntax check passed. If an error is reported, correct the file and run the command again. Do not reload until it succeeds.
sudo systemctl reload sshA reload applies the policy to new connections while allowing the current administrative session to remain open. Now test from a separate terminal:
sftp [email protected]
sftp> pwd
sftp> put test.txt
sftp> lsThe upload should succeed only in the writable child directory. If the client starts at the jail root, change into files before uploading:
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
sftp> cd files
sftp> put test.txt
sftp> lsTest the negative case separately with a normal SSH client:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →ssh [email protected]The account should not receive a normal shell. A forced SFTP session or an immediate refusal is expected; it should not provide a command prompt that can run arbitrary host commands. Within SFTP, attempts to use paths above the jail should not reveal the VPS filesystem.
When a connection fails, inspect the service log while repeating the test:
sudo journalctl -u sshSome distributions also record authentication events in a separate system authentication log. Use the log message, the account’s group membership, and the path checks together rather than guessing which layer failed.
Troubleshoot the failures that occur most often
| Symptom | Likely cause | Correction |
|---|---|---|
bad ownership or modes for chroot directory |
A component of the ChrootDirectory path is not root-owned or is writable by group or others. |
Run namei -l /srv/sftp/alice. Set each component to root ownership and a non-group-writable mode, then retry the login. |
SFTP login works but upload returns Permission denied |
The user is trying to write to the root of the jail, which must remain protected. | Use the child directory, such as files, and verify it is owned by alice:sftpusers with a mode that permits the intended operation. |
| The SFTP subsystem will not start | A conflicting Subsystem sftp definition or an unsupported forced-command configuration. |
Review the effective SSH configuration and the installed OpenSSH manual. Keep one supported subsystem arrangement and ensure ForceCommand internal-sftp is inside the intended Match block. |
| Public-key authentication fails | Wrong client key, incorrect AuthorizedKeysFile path, unsuitable ownership or modes, or a StrictModes check failure. |
Confirm the client is offering the expected private key, verify the server-side path before chrooting, and correct ownership and permissions. |
| New administrative logins stop working | A syntax, scope, ownership, or authentication mistake was reloaded. | Use the still-open administrative session to restore the previous snippet, run sshd -t, and reload only after the configuration is valid. |
Operational checks after the first successful login
- Confirm every intended transfer user belongs to
sftpusersand that no administrative account does. - Review the jail path after creating or renaming users. The
%uexpansion must resolve to a directory with the exact root ownership and mode requirements. - Keep uploads in purpose-specific child directories rather than changing the jail root to be writable.
- When changing authentication policy, test a new key-based connection before disabling passwords.
- After editing any included snippet, run
sudo sshd -tbeforesudo systemctl reload ssh. - Retain a separate administrative session during every SSH policy change and close it only after SFTP, shell-denial, and log checks pass.
When a chroot is worth the extra complexity
A regular SFTP account is appropriate when the person already needs ordinary Linux access and the existing filesystem permissions are sufficient. It has fewer moving parts: no root-owned jail path, no writable-child convention, and less specialized key-file placement.
A chrooted SFTP-only account is appropriate when the transfer boundary itself is a requirement. The combination of ChrootDirectory, ForceCommand internal-sftp, DisableForwarding yes, and PermitTTY no removes shell, terminal, forwarding, and outside-path access from the account’s normal SSH session. The trade-off is exacting filesystem ownership and a more deliberate recovery process. If those permissions are not maintained, the account may fail to log in or may be unable to write where intended.
Complete example for one user
The following sequence shows the intended order on an Ubuntu VPS. Run it from an open administrative session, adjust the username and paths when creating additional accounts, and do not skip validation:
sudo apt update
sudo apt install openssh-server
sudo systemctl enable --now ssh
sudo groupadd --system sftpusers
sudo useradd --create-home --home-dir /srv/sftp/alice
--shell /usr/sbin/nologin --gid sftpusers alice
sudo passwd alice
sudo mkdir -p /srv/sftp/alice/files
sudo chown root:root /srv /srv/sftp /srv/sftp/alice
sudo chmod 755 /srv /srv/sftp /srv/sftp/alice
sudo chown alice:sftpusers /srv/sftp/alice/files
sudo chmod 700 /srv/sftp/alice/files
sudo sshd -t
sudo systemctl reload sshAfter the reload, add and verify the client key if you are using key authentication, connect with sftp [email protected], change to files, upload a test file, and then verify that ssh [email protected] does not produce a shell. This sequence leaves the protected jail root owned by root while granting write access only to the child directory.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
