What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To change where an SFTP session starts, change the account’s home directory. If the user must be confined to one filesystem tree, add ChrootDirectory; after authentication, sshd changes into the user’s home directory inside that jail. For an SFTP-only account, pair the jail with ForceCommand internal-sftp.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
On Windows, the SFTP subsystem can also use the -d start/upload-directory option. The correct configuration depends on whether you need only a different starting folder or a genuine filesystem boundary.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
How SFTP chooses the starting directory
There are two separate settings that are often confused:
- Home directory: the operating-system account property that normally becomes the session’s starting location.
- Chroot directory: a replacement filesystem root. The user can see only this tree, and the home directory is interpreted inside it.
The OpenSSH portable sshd_config(5) documentation states: “After the chroot, sshd changes the working directory to the user’s home directory.” This means a chroot does not itself select the final folder. It changes what / means; the account home then determines where the user starts within that new root.
#1 Best Overall
For SFTP-only access, ForceCommand internal-sftp selects OpenSSH’s in-process SFTP server and prevents the account from receiving a normal shell session. Debian’s sshd_config(5) manpage describes internal-sftp as an in-process SFTP server. On Windows, Microsoft also documents the -d option on the external sftp-server.exe subsystem to set a starting or upload directory.
| Control | What it changes | Typical use |
|---|---|---|
| Account home directory | The normal post-login working directory | Put a trusted user in a project or data folder without restricting the rest of the account’s filesystem access |
ChrootDirectory |
The filesystem root visible after authentication | Confine an account to an SFTP tree |
ForceCommand internal-sftp |
Replaces the requested shell or command with the in-process SFTP server | Create an SFTP-only account, usually together with a chroot |
sftp-server -d |
Selects a start/upload directory for the external subsystem | Windows configurations that use sftp-server.exe rather than the internal server |
Choose the configuration that matches your goal
Only change the landing directory
Leave ChrootDirectory unset and change the account’s home directory with the user-management tool supplied by your operating system. The account retains its normal filesystem visibility and, unless other restrictions exist, may still obtain a shell or use forwarding.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteConfine the user to one tree
Use a Match User or Match Group block containing ChrootDirectory. Set the account’s home to a path that exists inside the jail, such as /upload. The host path might be /srv/sftp/alice/upload, but the user sees it as /upload.
Provide SFTP and nothing else
Add ForceCommand internal-sftp and normally disable forwarding with X11Forwarding no and AllowTcpForwarding no. A forced internal SFTP command prevents interactive shell use while preserving file-transfer access.
Linux OpenSSH: change the directory without a jail
When isolation is unnecessary, the simplest design is an ordinary home-directory change.
- Choose a directory that the account should enter after authentication.
- Ensure the directory exists and has the ownership and permissions required by the application or transfer workflow.
- Change the account’s home field with your distribution’s supported account-management utility. On systems whose
usermodsupports it, an illustrative form issudo usermod -d /data/incoming alice; verify the local command’s behavior before using it on a production system. - Inspect the resulting account record with the platform’s account database tools, for example
getent passwd aliceon systems that providegetent. - Start a new SFTP session. Existing sessions do not automatically change their current directory.
Do not add a chroot merely to change the landing folder. A chroot introduces ownership requirements and changes every path the user can see.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Linux OpenSSH: build an SFTP-only chroot
1. Create the filesystem layout
A practical layout is:
/srv/sftp/alice/ # chroot root, not writable by alice
/srv/sftp/alice/upload/ # writable directory inside the jailThe chroot directory and every parent component used to reach it must be owned by root and must not be writable by the group or by other users. The writable location belongs below the chroot root. Giving the SFTP account write permission on the chroot directory itself commonly causes a “Bad ownership or modes” refusal.
2. Configure a user-specific block
Add a block to sshd_config such as:
Match User alice
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
X11Forwarding no
AllowTcpForwarding no%u expands to the authenticated username, so Alice’s jail becomes /srv/sftp/alice. A group-scoped block can apply the same policy to several accounts, but check that the directory structure and permissions are correct for every member.
3. Set the home path inside the jail
Set Alice’s account home to /upload, not to the host’s absolute path /srv/sftp/alice/upload. After chrooting, that host path is visible to the session as /upload. If you set the home to a path that exists only outside the jail, sshd cannot enter it and the login may fail or land somewhere unexpected.
4. Check the SFTP subsystem
The global Subsystem sftp directive must refer to an available external sftp-server binary or use internal-sftp, depending on the installation. A forced internal server does not require a separate executable for the user-specific command, but the overall configuration still has to contain a valid subsystem definition for other sessions and for the server to start cleanly.
5. Validate before restarting
Run:
sudo sshd -tNo output indicates that the syntax check passed. If it reports an error, correct the configuration before restarting the SSH service. Microsoft’s OpenSSH guidance makes the same validation point for Windows: run sshd -t every time the server configuration changes.
6. Test the effective result
Open a new client session:
sftp [email protected]At the SFTP prompt, use pwd to display the server-side current directory and ls to verify that the expected files are visible. Try a permitted upload into /upload. Also confirm that the account cannot browse above the jail and that an SSH shell request does not provide an interactive shell when ForceCommand internal-sftp is active.
Rank #4
Windows OpenSSH: set a start directory or create a jail
Use the external subsystem’s -d option
Microsoft’s troubleshooting guidance documents the -d switch with a subsystem declaration such as:
Subsystem sftp sftp-server.exe -d D:SFTPaliceuploadUse the path syntax accepted by the installed OpenSSH build and keep the directory on a local volume. This option is for the external SFTP server. If you instead use ForceCommand internal-sftp with a chroot, the account home path inside the chroot determines the landing directory.
Configure an isolated account
In sshd_config, a user-specific policy can look like:
Match User alice
ChrootDirectory D:SFTPalice
ForceCommand internal-sftp
X11Forwarding no
AllowTcpForwarding noCreate a writable child directory such as D:SFTPaliceupload. Configure the account’s home so that it resolves to the directory visible inside the jail, rather than supplying a host path that is outside the chroot namespace.
Best Value
Set ownership and NTFS permissions
Windows chroot checks differ from Linux mode checks. Microsoft’s guidance requires a local chroot path and correct ownership and NTFS ACLs. Ensure that SYSTEM and Administrators own the chroot location as required by the OpenSSH installation, and grant the SFTP user write access only to the intended child directory. Do not make the chroot root broadly writable.
Validate and restart the service
- Run
sshd -tfrom an elevated shell to validate the edited configuration. - If validation succeeds, restart the service named
OpenSSH SSH Serverusing the Services console or the service-management command available on the host. - Start a new SFTP connection and run
pwdandlsto verify the visible root and starting folder.
If the service refuses to start, check the OpenSSH event or text logs after restoring the last known-good configuration. A syntax check catches configuration errors before a restart; logs explain permission, path, and runtime failures that syntax alone cannot detect.
Path semantics that cause most mistakes
The home path is relative to the chroot view
With ChrootDirectory /srv/sftp/alice and a home directory of /upload, the physical directory is /srv/sftp/alice/upload, while the SFTP client sees /upload. Referring to the physical path in the account’s home field points outside the new root and is therefore wrong.
A chroot is not a permission grant
Chrooting changes visibility; it does not automatically create a writable directory. Create the child directory separately and grant the account the minimum write access it needs.
A starting directory is not the same as isolation
An ordinary home-directory change places the user in a folder but does not stop deliberate navigation to other readable paths. Use ChrootDirectory when the requirement is “this account must not see outside this tree.”
Troubleshooting by symptom
| Symptom | Likely cause | What to check or change |
|---|---|---|
| The user lands in the wrong directory | The account home is wrong, the home is outside the chroot namespace, or an external subsystem still has a -d option |
Inspect the account’s home value, calculate the path as seen inside the jail, and review the effective Subsystem sftp line |
| Login fails with “Bad ownership or modes” | A Linux chroot component is writable by the user, group, or other users | Make every chroot component root-owned and non-writable by group and other users; keep write access in a child directory |
| Windows login is refused | The chroot is on a non-local path or its NTFS ACLs and ownership do not satisfy OpenSSH | Move the jail to a local path and verify SYSTEM, Administrators, and user ACLs |
| The user can see more of the server than intended | No matching Match block was applied, or only the home directory was changed |
Use a correctly scoped Match User or Match Group block with ChrootDirectory, then validate and start a new session |
| The configuration appears to be ignored | The edited file contains a syntax error, the wrong service was restarted, or the client reused an existing session | Run sshd -t, restart the OpenSSH service, and reconnect rather than testing an old session |
| The service will not start after editing | A malformed directive, invalid path, or unsupported subsystem setting | Run sshd -t, read the OpenSSH logs, and restore the previous working configuration if necessary |
Linux and Windows approaches compared
| Decision axis | Ordinary home-directory change | Chroot plus forced internal SFTP |
|---|---|---|
| Isolation | Changes the initial location only; other readable paths remain accessible | Replaces the visible filesystem root and is suitable for confinement |
| Scope | Usually one account’s home property | One user or group through a Match block |
| Linux requirements | Valid account home and normal filesystem permissions | Root-owned, non-writable chroot components plus a writable child directory |
| Windows requirements | Valid account and directory permissions | Local chroot path, required SYSTEM/Administrators ownership, and correct NTFS ACLs |
| SFTP implementation | External or internal subsystem, according to the server configuration | ForceCommand internal-sftp is the usual choice for an SFTP-only jail |
| Operational safety | Validate account changes and test a fresh session | Run sshd -t before every restart and inspect logs after failures |
Deployment checklist
- Decide whether you need a different starting folder or a filesystem jail.
- For a jail, design the physical tree and the path the user should see inside it.
- Keep Linux chroot parents owned by
rootand not writable by group or other users. - On Windows, use a local chroot and verify NTFS ownership and ACLs.
- Place upload and working permissions on a child directory, not on the chroot root.
- Use a
Match UserorMatch Groupblock so the restriction applies only to intended accounts. - Set the account home to the path visible inside the jail, such as
/upload. - Use
ForceCommand internal-sftpwhen shell access is not required. - Disable forwarding features that the account does not need.
- Run
sshd -tbefore restarting the service. - Reconnect and verify with SFTP
pwd,ls, upload, and access-boundary tests.
What the authoritative manuals establish
The OpenSSH portable manual defines the post-chroot directory change: after entering the chroot, sshd changes to the user’s home directory. Debian’s manpage documents internal-sftp as an in-process server, which is why it works cleanly with a forced SFTP-only command and does not require a separate server binary inside the jail. Microsoft’s OpenSSH troubleshooting guidance requires configuration validation with sshd -t after each change and documents the external subsystem’s -d start/upload-directory option on Windows.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
