Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesUse OpenSSH’s ForceCommand internal-sftp in a user- or group-specific Match block. It forces that account to use the in-process SFTP server for every session, so the account can transfer files but cannot select an interactive shell or run arbitrary SSH commands. Add ChrootDirectory when the user must see only a dedicated directory tree. A root-owned chroot, a writable child directory, and a syntax-checked configuration are the parts that usually determine whether the setup works securely.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What an SFTP-only account actually does
SFTP is a file-transfer subsystem carried inside an SSH connection; it is not the same protocol as unencrypted FTP. During login, an SSH client can request a shell, execute a command, allocate a terminal, or start the SFTP subsystem. OpenSSH lets you force a selected account or group to use only its in-process SFTP server.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ForceCommand internal-sftp applies to shell requests, command requests, and subsystem requests. The matched account therefore cannot obtain an interactive shell or choose another server-side command. It must use an SFTP client for file transfers. IBM’s OpenSSH guidance describes this in-process server as allowing file transfer for users who do not have shell access.
This restriction is separate from filesystem isolation. Without a chroot, the user remains in the normal filesystem namespace and can see any paths that ordinary Unix permissions expose. Add ChrootDirectory when the account should see only a restricted tree.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose between SFTP-only and chrooted SFTP-only
| Design | Shell and command access | Filesystem view | Operational work | When it fits |
|---|---|---|---|---|
| SFTP-only | ForceCommand internal-sftp blocks interactive shells and arbitrary command requests. |
Normal filesystem namespace, subject to Unix permissions. | Group configuration and account permissions; no chroot ownership layout. | Trusted users who need transfer access to existing paths and do not need a shell. |
| Chrooted SFTP-only | The same ForceCommand internal-sftp restriction. |
ChrootDirectory makes a selected directory appear as the user’s filesystem root. |
Every chroot path component must pass ownership and mode checks; writable data belongs in a child directory. | External users, shared services, or any account that should have a smaller filesystem blast radius. |
Chrooting does not replace the command restriction. Use both directives when you need file transfer without shell access and a limited filesystem view. Conversely, an SFTP-only account without a chroot can be useful when an existing application directory must remain at its current absolute path and normal Unix permissions already provide adequate separation.
A non-chroot SFTP-only variant
If the user needs access to selected existing paths and does not need a private filesystem root, omit ChrootDirectory but retain the command and forwarding restrictions:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Match User alice
ForceCommand internal-sftp
DisableForwarding yes
PermitTTY noThis still handles shell, command, and subsystem requests with the in-process SFTP server. It does not hide paths outside Alice’s permitted directories. Use Unix ownership, groups, and mode bits to decide which files she can read or modify. A group-based block is usually easier to maintain when several accounts share the same policy; a user-based block is useful for one exception or a small deployment.
Recommended OpenSSH configuration
Define the SFTP subsystem globally, then place restrictions in a Match Group block. The following example covers every account in the sftpusers group and gives each one a separate directory under /srv/sftp:
Subsystem sftp internal-sftp
Match Group sftpusers
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
DisableForwarding yes
PermitTTY noSubsystem sftp internal-sftp tells OpenSSH which implementation to start for normal SFTP subsystem requests. The decisive restriction is ForceCommand internal-sftp: a matched account cannot replace SFTP with a shell or another command. The %u token expands to the authenticated username, so user alice is chrooted at /srv/sftp/alice.
DisableForwarding yes disables TCP forwarding, agent forwarding, X11 forwarding, and stream-local forwarding for the matched account. PermitTTY no prevents allocation of a terminal. Keep the Match block at the end of the file, or otherwise verify its scope carefully; a misplaced block can unintentionally change settings for later directives or accounts.
Directive defaults and available options vary among OpenSSH and Linux distribution releases. Check the installed system’s sshd_config(5) manual before deploying the configuration. If the file includes snippets from a directory such as an administrator-managed configuration include path, inspect those files too when determining which setting wins.
Build a chrooted SFTP user step by step
1. Create a dedicated group and account
- Create a group used only for restricted SFTP accounts:
sudo groupadd sftpusers - Create the account with a non-login shell as an additional safeguard:
sudo useradd -g sftpusers -s /usr/sbin/nologin alice
The non-login shell is defense in depth, not the mechanism that creates an SFTP-only account. A non-login shell alone does not create a chroot and does not reliably constrain forwarding. ForceCommand internal-sftp is the OpenSSH control that handles shell, command, and subsystem requests.
Use a dedicated group rather than adding external accounts to an administrator group. Group membership is what makes the conditional policy apply, so record the intended membership and review it when an account is created, transferred, or removed.
2. Create the root-owned directory tree
The chroot itself and every component of its path must be owned by root and must not be writable by the group or by others. Give the SFTP user write access only to a directory below the chroot:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo mkdir -p /srv/sftp/alice/upload
sudo chown root:root /srv/sftp /srv/sftp/alice
sudo chmod 755 /srv/sftp /srv/sftp/alice
sudo chown alice:sftpusers /srv/sftp/alice/upload
sudo chmod 750 /srv/sftp/alice/uploadThe resulting layout is:
| Path | Owner | Mode | Purpose |
|---|---|---|---|
/srv/sftp/ |
root:root |
0755 |
Dedicated SFTP hierarchy. |
/srv/sftp/alice/ |
root:root |
0755 |
Chroot root; not writable by Alice. |
/srv/sftp/alice/upload/ |
alice:sftpusers |
0750 |
Writable data directory inside the chroot. |
When a user connects, the chroot root appears as /. The writable directory is therefore visible to the SFTP client as /upload, not as /srv/sftp/alice/upload. Adjust group ownership and modes if several accounts must collaborate, but never make the chroot root itself user-writable.
Every parent component matters. For example, if /srv or /srv/sftp is group-writable, OpenSSH can reject the login even when /srv/sftp/alice itself is correctly owned. The path can be inspected before testing with namei -l.
With internal-sftp, the chroot does not need a shell binary, shared libraries, or ordinary device nodes. If your logging setup writes through syslog from inside the chroot, the platform may still require a /dev/log socket in that environment.
3. Install the user’s authentication key
Place Alice’s public key in the location specified by the server’s AuthorizedKeysFile setting, using the distribution’s supported authentication method. The key file normally remains outside the chroot in the account’s regular home or administrator-managed key directory; authentication occurs before the SFTP process enters the chroot. Ensure the key file and its parent directories have permissions accepted by your OpenSSH configuration.
Do not move the key into the writable upload directory. Keeping credentials in an administrator-controlled location prevents the transfer area from becoming a place where the account can alter its own authentication material.
4. Add the restriction to sshd_config
Edit /etc/ssh/sshd_config. Leave the global subsystem declaration outside conditional blocks, then append the group restriction:
Subsystem sftp internal-sftp
Match Group sftpusers
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
DisableForwarding yes
PermitTTY noIf the file already defines a different SFTP subsystem, retain one valid global definition and avoid creating conflicting declarations. Make sure Alice is actually a member of the group:
id aliceConditional settings are evaluated for the connection being authenticated. A typo in the group name, an account that has not picked up new group membership, or a later included policy can therefore produce a configuration that parses successfully but does not match the intended user.
5. Validate before reloading
Always check syntax before asking the running daemon to reread its configuration:
sudo sshd -tNo output and a successful exit indicate that the configuration parses. If the command reports an error, correct it before reloading. Keep an existing administrative SSH session open while changing SSH access so a mistake does not remove your only recovery path.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Reload using the service manager used by your distribution, for example:
sudo systemctl reload sshdSome distributions name the service ssh rather than sshd; use the service name installed on that system. A reload applies the new policy to new connections while an already established administrative session remains available for recovery.
6. Test from a separate client
From another terminal or host, test the intended protocol:
sftp alice@serverConfirm that Alice can list the chroot and upload a file to /upload. Then test an SSH login:
ssh alice@serverThe second connection must not provide an interactive shell. Command-style SSH requests and shell selections should also be forced into the internal SFTP service rather than executed. Clients should use SFTP for transfers; do not assume that an SCP workflow will remain available when the account is forced to the SFTP subsystem.
Test both a successful operation and a denied one: upload into the writable child, then attempt to write directly to the chroot root. The latter should fail because the root is intentionally owned by root. Also test a fresh login after the daemon reload rather than relying only on a connection created before the change.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Hardening choices for production
Disable forwarding explicitly
DisableForwarding yes is the broad restriction for forwarding facilities. It prevents the account from turning an otherwise file-transfer-only credential into a tunnel for TCP, agent, X11, or stream-local connections. Include it even if you do not currently expect the account to use those features.
Do not allocate a terminal
PermitTTY no stops terminal allocation for the restricted account. This complements, but does not replace, ForceCommand internal-sftp.
Use a dedicated hierarchy for multiple users
A per-user path such as /srv/sftp/%u keeps external users’ trees separate and avoids sharing one writable chroot root. A dedicated partition or filesystem can make capacity, backup, and monitoring easier to manage. ANSSI guidance recommends a dedicated hierarchy for users or groups dedicated to SFTP and notes that nodev, noexec, and nosuid mount options may be appropriate depending on the filesystem and partitioning design. Those mount options are deployment choices, not substitutes for correct OpenSSH directives and ownership checks.
Separate trees also simplify offboarding: archive or remove one user’s directory without changing another user’s chroot. If collaboration is required, use an explicitly chosen shared group and directory modes rather than making the chroot root writable.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Keep conditional scope predictable
OpenSSH evaluates settings in the context of the connection. A broad Match Group placed too early can affect settings intended for other users, while a block that does not match Alice leaves her unrestricted. Keep the block clearly separated and inspect the effective result for the exact connection parameters.
Use sshd -T -C with the actual username, host, and client address when troubleshooting scope. This shows the effective values after conditional matching, which is more reliable than reading a long configuration file and guessing which block applied.
Comparison: what you gain and what you maintain
| Consideration | SFTP-only | Chrooted SFTP-only |
|---|---|---|
| Shell and command restriction | ForceCommand internal-sftp blocks interactive shells and arbitrary commands. |
The same restriction applies. |
| Filesystem visibility | Normal namespace, limited by Unix permissions. | Only the configured chroot tree is visible. |
| Setup complexity | Lower; no special root-owned path is required. | Higher; every path component must pass ownership and mode checks. |
| Isolation and blast radius | Depends on careful file permissions. | A dedicated hierarchy and optional restrictive mount options reduce exposure. |
| Best fit | Trusted internal transfers to existing directories. | External users, partner exchange, or separate service accounts. |
The extra chroot work is justified when filesystem visibility matters. It is unnecessary complexity when a trusted account already needs access to established paths and those paths are correctly protected with Unix permissions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting common failures
“Bad ownership or modes for chroot directory”
OpenSSH checks every component of the chroot path, not only the final directory. Inspect the complete path:
Recommended Free Tools
namei -l /srv/sftp/aliceMake /srv, /srv/sftp, and /srv/sftp/alice root-owned and non-writable by group or others. Put writable content in /srv/sftp/alice/upload or another child directory instead.
SFTP connects, but the directory is empty or unwritable
An empty root can be expected when the chroot contains only its root directory. Create a child such as upload and grant the account ownership or suitable group permissions there. Do not solve the problem by making the chroot root writable; that fails OpenSSH’s security check.
SFTP works, but SSH still opens a shell
First verify group membership with id alice. Then inspect the effective configuration for the connection:
sudo sshd -T -C user=alice,host=example,addr=192.0.2.10Confirm that the output includes forcecommand internal-sftp, the expected chrootdirectory, and the forwarding and TTY restrictions. If those values are absent, check the spelling of the group, the location and scope of the Match block, and whether a different included configuration file overrides the setting. Reload only after sshd -t succeeds.
Free tools Windows power users keep installed
One-click scans. No signup required.
Logging fails after chrooting
The in-process SFTP server does not need a shell or shared libraries, but systems that send internal-SFTP logs through syslog may require /dev/log inside the chroot. Review the platform’s logging arrangement and create the required socket path only according to that platform’s documented procedure.
Reload fails or administrators are locked out
Run sshd -t before every reload and retain an existing administrative session until a new administrator login has been tested. If a reload reports an error, restore the last known-good configuration and correct the reported directive before trying again.
The account is in the group but remains unrestricted
Check the account’s current supplementary groups and the exact group spelling. Then run sshd -T -C with the same username and source address used by the test. This distinguishes a membership problem from a conditional-block or include-file problem. A successful syntax check alone does not prove that the intended block matched.
What this setup blocks—and what it does not
- Blocked for matched accounts: interactive shell access, arbitrary command execution through SSH, terminal allocation when
PermitTTY nois set, and forwarding whenDisableForwarding yesis set. - Allowed: SFTP operations permitted by Unix ownership and mode bits inside the chroot, such as listing, uploading, downloading, renaming, and deleting files in writable directories.
- Not automatically isolated: without
ChrootDirectory, the account retains the normal filesystem view allowed by Unix permissions. - Not fixed by
nologinalone: a non-login shell does not enforce SFTP, create a chroot, or disable forwarding. - Not a replacement for backups or quotas: the directives control access and visibility; storage capacity, retention, and recovery still require normal filesystem administration.
For a typical external-transfer account, the combination of a dedicated group, ForceCommand internal-sftp, ChrootDirectory /srv/sftp/%u, root-owned chroot components, a writable child directory, disabled forwarding, and a validated reload provides the intended “file transfer, no shell” behavior.
Recommended Free Tools
Frequently Asked Questions
How do I enable SFTP without giving a user SSH shell access?
Create or select a dedicated user or group and apply ForceCommand internal-sftp in a matching Match User or Match Group block. Add DisableForwarding yes and PermitTTY no for a tighter transfer-only policy. Validate with sshd -t, reload the daemon, and test both SFTP and SSH from a separate client.
Do I need a chroot for an SFTP-only account?
No. ForceCommand internal-sftp blocks shells and arbitrary commands by itself. Add ChrootDirectory when the account must see only a restricted directory tree. Without it, normal Unix permissions determine which paths are visible and writable.
Why must the chroot directory be owned by root?
OpenSSH checks every component of the configured chroot path and rejects components writable by the user, group, or others. Keep the chroot hierarchy root-owned and place user-writable data in a child such as /upload.
Can an SFTP-only user use SCP?
Do not depend on SCP for a forced internal SFTP account. ForceCommand internal-sftp handles shell, command, and subsystem requests with the SFTP server, so clients should use the SFTP protocol for transfers.
Does /usr/sbin/nologin create an SFTP-only account?
No. It is useful defense in depth, but it does not create a chroot or disable forwarding. The OpenSSH directive that enforces the transfer-only behavior is ForceCommand internal-sftp.
Where should the user’s public key be stored after chrooting?
Use the location specified by the server’s AuthorizedKeysFile setting, normally in the account’s regular home or an administrator-managed key directory outside the writable chroot data area. Authentication occurs before the SFTP process enters the chroot.
Why can the user connect but not upload?
The chroot root is intentionally non-writable. Create a child directory such as /srv/sftp/alice/upload, give it ownership or group permissions suitable for the account, and use /upload from the SFTP client.
How can I verify which settings apply to one account?
Run sudo sshd -T -C user=alice,host=example,addr=192.0.2.10. Check for forcecommand internal-sftp, the expected chrootdirectory, and the forwarding and TTY restrictions. Also confirm membership with id alice.
What should I do if logging fails inside the chroot?
The in-process server needs no shell or shared libraries, but a platform that sends internal-SFTP logs through syslog may require a /dev/log socket inside the chroot. Follow the logging procedure documented for that operating system.
The Bottom Line
For a Linux account that must transfer files but never receive an SSH shell, use a dedicated group with ForceCommand internal-sftp. Add DisableForwarding yes and PermitTTY no, and add ChrootDirectory /srv/sftp/%u when filesystem isolation is required. Keep every chroot component root-owned and non-writable, give the user access to a child directory, run sshd -t before reloading, and verify both SFTP success and SSH-shell failure from a separate client.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
