SFTP problems on a VPS become much easier to fix when you separate the failure into layers. SFTP runs through SSH, so first determine whether the VPS is reachable, whether SSH accepts the account, whether the SFTP subsystem starts, or whether the logged-in account lacks permission to use a path. Then make one evidence-based change at a time: validate the SSH configuration with sudo sshd -t, correct key and account policy, repair chroot ownership, and provide a writable directory inside the jail. If normal SSH access is unavailable, use the VPS provider’s serial console rather than repeatedly changing settings without seeing the server logs.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Start by identifying the failing layer
An SFTP client can report the same generic connection error for several unrelated causes. A failed TCP connection is not an SFTP configuration problem; a rejected key is not a directory-permission problem; and a successful login followed by Permission denied points to the filesystem or access policy. Use the symptom and the last successful stage to choose the next check.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| What you observe | Most likely layer | First action |
|---|---|---|
| The VPS name does not resolve or the TCP connection to port 22 (or your configured SSH port) fails | DNS, routing, firewall, security group, or provider status | Check address resolution, the VPS firewall and security-group rule, routing, and the provider’s status before changing SFTP settings. |
| SSH reaches the server but reports authentication failure or the server refused the key | Username, key selection, authorized-keys policy, account restrictions, or accepted algorithm | Run a verbose client test and correlate it with the server authentication log. |
| Authentication succeeds, but the SFTP session closes immediately | Invalid SSH configuration, missing or incorrect SFTP subsystem, or a failing Match rule |
Run sudo sshd -t, inspect the effective subsystem configuration, and read the service log. |
| Login succeeds, but changing directory or uploading returns Permission denied | Chroot ownership, Unix permissions, ACLs, or the selected path | Check the host-side path and the path as seen inside the SFTP jail; make a child directory writable rather than the chroot root. |
This separation prevents a common mistake: changing file modes when the VPS is not reachable, or loosening a chroot when the real problem is an incorrect username or key.
Reproduce the failure with useful evidence
Use verbose SFTP output
For an OpenSSH client, reproduce one failure with:
sftp -vvv user@hostRecord the username, address, port, selected identity, the last successful negotiation step, and the exact server message. If the server uses a nonstandard SSH port, include that configured port in the client command. The verbose trace helps distinguish a network timeout from host-key negotiation, authentication rejection, subsystem startup, and a later file-operation error.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Read the server-side record
Do not treat a graphical SFTP application’s connection failed notice as a diagnosis. Check the authentication log and the service journal on the VPS. Many Debian-family systems write authentication events to /var/log/auth.log; many RHEL-family systems use /var/log/secure. The exact service name, journal unit, and log routing vary with the image and OpenSSH package, so use the locations supplied by that distribution. Correlate the timestamp of one reproduction with the server entry.
Server logs can tell you whether a key was rejected before a session was created, whether an account was denied by an AllowUsers, AllowGroups, or Match rule, or whether the session reached a chroot and then failed an ownership or filesystem check. That distinction determines whether you should edit identity files, sshd_config, or directory permissions.
When the VPS is unreachable: fix the network layer first
Confirm name and address resolution
Verify that the hostname resolves to the intended VPS address. A stale DNS record, an address typo, or an IPv4/IPv6 path that is not configured on the server can look like an SFTP outage. Test the address that the client is actually using, not only an address copied from a control-panel page.
Check the listening port and filtering points
SFTP normally uses the SSH listener, commonly TCP port 22, unless the administrator configured another port. If the TCP connection fails, inspect every filtering point in order:
- the VPS provider’s security-group or network-firewall rule;
- the operating system’s host firewall;
- routing between the client network and the VPS;
- the provider’s infrastructure or instance status.
Changing Subsystem sftp cannot repair a blocked TCP port. Resolve reachability first, then rerun the verbose SFTP test. If ordinary SSH is unavailable because of a boot, network, or SSH configuration problem, use the provider’s serial console. AWS specifically recommends serial-console access for this kind of recovery, provided the account and instance support it.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Repair authentication and public-key failures
Confirm the connection identity
Check all of the values the client is using: the VPS address, SSH port, username, and private-key file. A valid key presented for the wrong account is still rejected. Make sure the private key corresponds to the public key installed for that account, and avoid silently selecting a different identity from an SSH agent or client profile.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Verify the authorized-keys location and ownership
On the server, confirm that the public key appears in the account’s authorized-keys file or in the provider-documented alternative location. Check ownership and restrictive permissions on the account’s home directory, its SSH directory, and the authorized-keys file. A key can be correct while OpenSSH refuses to read it because a parent directory or the file is writable by an unintended user.
The exact acceptable modes depend on the distribution and any administrator policy, but the principle is consistent: the account should own its key material, and unrelated users should not be able to modify it. Correcting the key text alone will not fix a path that OpenSSH considers unsafe.
Check account policy and algorithm support
Review AllowUsers, AllowGroups, and applicable Match blocks in the SSH configuration. A broad global rule can be overridden by a later match-specific rule, so inspect the block that applies to the affected username. Also check the accepted public-key algorithms. Microsoft documents cases in which older OpenSSH deployments reject a key because the algorithm offered by the client is not accepted by the server. Prefer a current, mutually supported algorithm and update policy deliberately rather than enabling a weak legacy option without understanding the security consequence.
Use logs to separate key rejection from file denial
A key rejection occurs before the SFTP session is authenticated and is normally recorded as an authentication event. A successful login followed by Permission denied is a different event: the account authenticated, but the requested path or operation failed. This distinction is especially important with chrooted accounts, where the visible path can differ from the host path.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Validate sshd_config before restarting anything
Run the syntax check
Before restarting or reloading SSH, run:
sudo sshd -tA clean return means the configuration syntax is valid. It does not prove that every referenced path exists, that the SFTP implementation is installed, that permissions satisfy a chroot, or that your access policy is safe. If the command reports an error, fix that error and run the check again before attempting a service restart. This sequence reduces the risk of locking yourself out with a malformed directive.
Confirm the SFTP subsystem
Ensure that an active Subsystem sftp directive points to an installed server implementation. A typo in the path to an external sftp-server, a missing package, or an incorrectly scoped Match block can make SSH work while SFTP sessions fail.
For chrooted accounts, internal-sftp is often simpler because the subsystem runs inside OpenSSH and does not require an external SFTP binary inside the jail. Red Hat documents this advantage for chroot configurations. If you use an external sftp-server, its logging and runtime requirements must also be available in the chroot; the required /dev/log arrangement is one reason an external subsystem can fail after authentication.
Remember that Match changes the effective configuration
Read the global directives and the user-specific Match block together. A user may receive a different subsystem, chroot path, authentication method, or start directory than the global default. A syntactically valid file can therefore still produce an unintended session. Compare the block with the username and group used in the failing client test.
Fix chroot ownership without weakening the jail
Why a writable chroot root is rejected
OpenSSH checks the ownership and mode of each component of a chroot path. The jail root and its parent components must be owned safely and must not be writable by the SFTP user. If the root of the jail is user-writable, OpenSSH rejects the session with an error such as bad ownership or modes for chroot directory component. Making the jail root writable is not a valid quick fix; it defeats the boundary the chroot is meant to provide.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Use a root-owned jail and a writable child
The following layout illustrates the pattern for an account named alice and a group named sftp-users:
sudo chown root:root /srv/sftp/alice
sudo chmod 755 /srv/sftp/alice
sudo mkdir -p /srv/sftp/alice/uploads
sudo chown alice:sftp-users /srv/sftp/alice/uploads
sudo chmod 750 /srv/sftp/alice/uploadsAdjust the path, group, and modes to the policy of your VPS image. The important properties are that /srv/sftp/alice is root-owned and non-writable by alice, while /srv/sftp/alice/uploads is owned or otherwise writable by the account through the intended group. Check every parent component of the chroot path, not only the final directory.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Check all components, not just the upload folder
A correct-looking upload directory cannot compensate for an unsafe parent. Inspect ownership and mode on each component from the filesystem root through the configured chroot. The account needs execute permission on directories it must traverse, but the jail root must remain protected. If additional ACLs are used, review them as well; a traditional mode string may not show the complete access decision.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use the path the SFTP user actually sees
If the configuration contains ChrootDirectory /srv/sftp/%u, the host directory /srv/sftp/alice becomes / for user alice. The upload directory in the SFTP client is therefore /uploads, not /srv/sftp/alice/uploads. Trying to open the host path from inside the jail can produce a misleading missing-file or permission error.
After authentication, navigate to the jail root and then to the writable child. If the subsystem is configured with a start directory, use that setting to place the session directly in the intended location. Microsoft recommends a writable directory inside the chroot for this purpose. Keep the host-side path in administrative documentation, but give SFTP users the path visible inside the jail.
When login works but uploads fail
Check the destination directory
Confirm that the destination directory is the writable child you created, rather than the protected chroot root. The account needs permission to create or replace files there, and the filesystem must have available space and any required mount access. If a file already exists, its ownership and mode can independently prevent replacement.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCheck the operation, not only the directory
Uploading, renaming, deleting, and creating subdirectories each require permissions on the containing directory and, for some operations, the existing file. A client that can list a directory is not necessarily allowed to write to it. Correlate the failed operation with the server log and inspect the exact path reported by the client.
Do not broaden the jail to solve a path mistake
Granting write access to the chroot root may appear to make uploads work, but it creates the security condition OpenSSH is designed to reject. Keep the jail protected and add or repair a purpose-built child directory with the narrowest ownership and mode that meets the workflow.
Increase logging for one controlled reproduction
When the normal logs do not identify the stage, temporarily raise OpenSSH/SFTP logging, using a level such as DEBUG3 where supported. Reproduce one failed login or transfer, collect the corresponding server entries, and then return logging to the normal level. Leaving highly verbose logging enabled can create unnecessary log volume and expose operational details.
On Linux, use the authentication log and service journal mechanism supported by the distribution and by the selected SFTP subsystem. Red Hat describes verbose SFTP command logging and notes that an external sftp-server in a chroot may need access to /dev/log. With internal-sftp, that external logging dependency changes because the subsystem is built into OpenSSH. On Windows OpenSSH, Microsoft recommends checking Event Viewer for relevant events and verifying the generated SFTP log location. These platforms use different log facilities, so do not copy a Linux path into a Windows configuration or vice versa.
Free tools Windows power users keep installed
One-click scans. No signup required.
Recover safely when normal SSH access is gone
- Open the VPS provider’s serial-console session if your account and instance support it.
- Read the SSH service and authentication errors from the console-accessible logs.
- Inspect the recently changed configuration, especially
Subsystem sftp,Match, and chroot directives. - Run
sudo sshd -tbefore restoring or restarting the service. - Correct the smallest faulty setting, preserve a rollback copy, and retest from a normal client.
A serial console is particularly valuable after a malformed SSH configuration, boot problem, or network change has removed the normal management path. It provides an independent access route, so you can validate and repair the service without repeatedly guessing from the client side.
Choose a remedy by evidence, access, and risk
| Remedy | Failure layer addressed | Access required | Security consideration | How to validate |
|---|---|---|---|---|
| Correct firewall, security-group, routing, or provider issue | Network reachability | Provider control panel or network administration access | Open only the intended SSH port and source range | TCP connection succeeds, then verbose SFTP reaches authentication |
| Fix username, key file, authorized-keys path, or key permissions | Authentication | Working SSH, root/sudo, or provider console | Keep key files protected and use an accepted algorithm | Server log records successful public-key authentication |
Repair Subsystem sftp or a Match block |
Configuration and session startup | Root/sudo or serial console | Do not restart an unvalidated configuration | sudo sshd -t succeeds and one SFTP session starts |
| Make the chroot root protected and a child directory writable | Chroot and filesystem access | Root/sudo or serial console | Never make the chroot root writable by the SFTP user | Login succeeds; the user can write only in the intended child path |
| Raise logging briefly and correlate one reproduction | Evidence gathering across layers | Server administration access | Restore the normal log level after testing | The log identifies the rejected key, subsystem, chroot, or file operation |
Distribution and version differences to account for
- Debian-family and RHEL-family images commonly use different authentication-log paths:
/var/log/auth.logversus/var/log/secure. - The SSH service name, journal unit, package name, firewall tooling, and default key policy vary by VPS image and OpenSSH version.
- Windows OpenSSH uses Event Viewer and Windows-specific logging locations rather than the Linux files above.
- Accepted public-key algorithms can differ on older deployments; a key that works elsewhere may be rejected by this server’s policy.
- External
sftp-serverandinternal-sftphave different chroot and logging requirements.
Verify commands against the image and OpenSSH version running on your VPS. A syntactically valid configuration is only one checkpoint; paths, installed components, ownership, modes, and policy still have to match the account’s intended access.
A compact repeatable runbook
- Test name resolution and TCP reachability to the configured SSH port.
- Run
sftp -vvv user@hostand note the last successful stage. - Match that timestamp to the authentication log and service journal.
- If authentication fails, verify the username, selected private key, authorized-keys location, ownership, modes, account rules, and accepted algorithm.
- If the session fails after authentication, inspect
Subsystem sftpand all applicableMatchblocks. - Run
sudo sshd -tbefore any restart or reload. - For a chroot, keep every jail component safely owned and non-writable by the user; create a writable child such as
/uploads. - Use the chroot-relative path in the client, not the host’s absolute path.
- Raise logging only for a short reproduction, then restore the normal level.
- If normal SSH remains unavailable, make the repair through the provider’s serial console.
Following that order keeps network, authentication, SSH configuration, chroot, and file permissions separate. It also leaves an audit trail for each change and avoids the two most damaging quick fixes: restarting an unvalidated SSH configuration and making a chroot directory writable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
