The safest general pattern for a file-transfer account is an OpenSSH Match block that combines ChrootDirectory with ForceCommand internal-sftp. The account is confined to a root-owned directory, receives SFTP rather than a shell, and has forwarding features disabled unless a specific policy requires them.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A chroot alone is not an access policy. It changes the session’s apparent filesystem root after authentication, but it does not automatically remove shell commands, TCP forwarding, agent forwarding, X11 forwarding, or tunnel access. Those capabilities must be controlled separately and tested separately.
As an Amazon Associate I earn from qualifying purchases.
The configuration to start with
Create a dedicated Unix group for restricted transfer accounts and apply a group-scoped block in sshd_config. This keeps the policy separate from ordinary administrative accounts and makes it possible to add or remove users without duplicating directives.
Match Group sftpusers
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
AllowTcpForwarding no
AllowAgentForwarding no
X11Forwarding no
PermitTunnel noIn this example, %u is replaced with the authenticated user name. A user named alice therefore receives /srv/sftp/alice as the chroot directory. The account can work only with files placed below that directory, subject to the permissions on those files.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Put the block after the global directives. A Match block remains in effect until another Match line or the end of the file, so placing unrelated global settings below it can accidentally make them conditional. Keep the block easy to audit and add another Match section when a different policy begins.
What chroot changes—and what it does not
ChrootDirectory changes the root directory visible to the session after authentication. A process that sees /srv/sftp/alice as its root cannot use ordinary path traversal to reach the host’s real /etc, home directories, or other top-level paths.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The directive does not, by itself, choose the program that runs after login. Without another restriction, an account may still be able to start a shell, execute a requested SSH command, or use forwarding. This is why a filesystem jail and an SSH capability policy must be designed together.
Why ForceCommand internal-sftp matters
ForceCommand overrides the command supplied by the client and applies to shell, command, and subsystem execution. Setting it to internal-sftp forces the in-process SFTP server for every session matching the block. A client cannot replace that with an interactive shell or an arbitrary command.
The OpenBSD sshd_config(5) manual describes this behavior directly: specifying internal-sftp forces an in-process SFTP server that requires no support files when used with ChrootDirectory. Consequently, an ordinary ssh user@host request is not a shell login, and ssh user@host command is not an avenue for running that command. Depending on the client and platform, those attempts may be denied or terminate after the forced SFTP service is selected.
Forwarding is a separate decision
Filesystem confinement does not automatically prevent an account from asking the SSH server to forward connections. The sample policy explicitly disables:
AllowTcpForwarding nofor local and remote TCP forwarding.AllowAgentForwarding noso the account cannot use an SSH authentication agent through the session.X11Forwarding noto remove X11 display forwarding.PermitTunnel noto prohibit tunnel devices.
Leave a capability enabled only when the account’s purpose requires it. Test each forwarding type independently; a successful SFTP test proves nothing about forwarding behavior.
Build the jail with the required ownership model
OpenSSH checks the jail path when a session starts. The jail root and every parent component leading to it must be owned by root and must not be writable by the group or by other users. The check applies to every component of the ChrootDirectory path, not only the final directory.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
For the example path, inspect the complete hierarchy:
/srv
/srv/sftp
/srv/sftp/aliceEach of those components must satisfy the root-ownership and non-writable requirement. If any component is group-writable or writable by others, OpenSSH can refuse to start the session. The manuals warn that unsafe hierarchy permissions can create conditions that the daemon cannot reliably detect, so do not weaken this rule for convenience.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallPut writable data below the root
The account normally needs a place to upload or modify files. Do not make the chroot root itself writable. Instead, create a child such as /upload beneath the root-owned jail and grant the account access to that child.
/srv/sftp/alice root-owned, not writable by group or others
└── upload writable according to the account’s file policyThis layout separates the directory OpenSSH must trust from the directory the user is allowed to change. You can make the child writable for the account, share it with a controlled group, or make it read-only, depending on the transfer policy. The exact child permissions determine what the account can create, replace, rename, or delete.
Set the account’s home directory deliberately
After chrooting, sshd changes the working directory to the user’s home directory. Configure the account’s home so that it resolves inside the jail, then create that directory with the intended ownership and permissions.
For the common layout, the account’s home can resolve to / inside the jail, with writable work kept in /upload. Another layout can place the home at a child path, provided that path exists inside the jail and has the permissions you intend. What matters is that the post-chroot home path is real and useful rather than pointing to a location that exists only outside the jail.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A dedicated account or group is preferable to applying this policy to a mixed-use login. If local policy requires it, assign the account a non-interactive shell as an additional guard. The decisive SFTP-only control remains the Match block and its forced command.
Deploy the restriction in a controlled sequence
-
Create a dedicated account and group
Create the Unix group used by the
Match Groupcondition, create or select the transfer account, and add that account to the group. Confirm that the account is not unintentionally included in another policy block. If your operating policy uses a non-interactive login shell for transfer-only accounts, assign it now.Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
-
Create the complete jail path
Build the directory hierarchy represented by
/srv/sftp/%u. For each real user, substitute the user name and create the corresponding directory. Check every parent component, not just the per-user directory. -
Apply the trust boundary
Set the jail root and all of its parents to root ownership and remove group and other write permission. Do not place upload data directly in that root. Create a child directory such as
uploadand assign only the access needed by the account or its controlled group.Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Add the group-scoped policy
Append the representative
Match Group sftpusersblock after the global settings insshd_config. Keep the four forwarding restrictions unless a documented requirement says otherwise. -
Validate before reloading
Use the platform’s sshd configuration test mode before applying the change. On OpenSSH installations this is commonly invoked as
sshd -t; use the service’s documented test command if your platform names it differently. A syntax check catches malformed directives, but it does not prove that the jail ownership, home path, or child-directory permissions are correct. -
Keep an administrative session open
Do not close your existing administrative SSH session while reloading the daemon. If the new configuration prevents a login, the open session gives you a way to correct the file and reload again.
-
Reload the daemon
Reload sshd using the service manager appropriate to the operating system. A reload applies the configuration to new sessions while preserving the session you kept open for recovery.
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Test the intended SFTP workflow
Connect with an SFTP client as the restricted account. Verify the initial directory, directory listing, upload, download, rename, and deletion behavior that the policy is meant to permit. Confirm that the account sees the jail as its root and cannot name a path outside it.
-
Test rejected session types
Attempt both
ssh user@hostandssh user@host command. UnderForceCommand internal-sftp, neither should provide an interactive shell or execute the supplied command. Record the client’s actual result because messages vary by OpenSSH version and client.Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
-
Test forwarding separately
Attempt the forwarding modes relevant to your threat model, including TCP forwarding, agent forwarding, X11 forwarding, and tunnel requests. They should fail when the corresponding directives are set to
no. -
Inspect authentication and daemon logs
Review sshd and authentication logs for denied sessions, permission failures, and forced-command events. If you enable logging for an in-process SFTP session, provide the platform-required
/dev/logendpoint inside the jail where the operating system expects it.Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Why in-process SFTP is usually the simplest design
The internal-sftp subsystem runs inside sshd. Because it does not launch a separate binary and does not need support files when paired with ChrootDirectory, an SFTP-only jail can contain little more than the directory tree and data the account is allowed to use.
This is materially simpler than building a chroot for an interactive shell. A shell session needs a shell executable and the libraries and support files it depends on. It also needs basic device nodes, including equivalents for null, zero, standard streams, and terminal devices. Depending on the operating system and logging setup, the jail may additionally need a /dev/log endpoint. Every extra file and device increases the amount of content that must be maintained and checked.
Choosing between SFTP-only and an interactive shell
| Design | What the user receives | Jail contents | Main risks and trade-offs |
|---|---|---|---|
SFTP-only with internal-sftp |
File transfer through the in-process SFTP server; no shell or arbitrary SSH command under the forced command. | Root-owned jail hierarchy plus the directories and files used for transfer; no support files are required for the in-process server. | Simplest to maintain, but every required operation must be expressible through SFTP. |
| Interactive shell in a chroot | A shell and commands selected by the system administrator. | Shell, dependent libraries and support files, basic /dev nodes, and potentially a logging endpoint. |
More operational work and a larger attack surface; each executable and device must be maintained inside the jail. |
External sftp-server |
SFTP provided by a separate server process rather than the in-process subsystem. | Support files required by that external process may need to be present in the jail. | More packaging and path dependencies than internal-sftp; use only when a platform-specific requirement justifies it. |
For an account whose only job is moving files, the first row generally has the fewest moving parts. Choose an interactive shell only when the account genuinely needs commands, and then treat the shell environment as a separate build and maintenance project.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Read-only and writable layouts
| Layout | Typical use | Permission decision |
|---|---|---|
Root-owned jail with a writable /upload child |
Inbound file delivery or a working drop folder. | Grant write access only to the account or controlled group; keep the jail root immutable to the account. |
| Root-owned jail with read-only children | Outbound distribution where the account may download but must not alter files. | Make the data child readable and searchable without granting write permission. |
| Separate read and write children | Workflows that distinguish published files from incoming files. | Assign different ownership and mode policies to each child and test both paths. |
These are filesystem permission choices below the chroot boundary. They do not replace the SSH restrictions in the Match block.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common failure modes and precise fixes
“Connection closed” immediately after authentication
First inspect the ownership and mode of every component of the chroot path. OpenSSH performs this startup check before the session is established. Correct the hierarchy so the components are root-owned and not writable by group or others, then retry.
The account can authenticate but cannot upload
Check the child directory used for uploads, not the jail root. The root is intentionally not writable. Give the account the required write and search permissions on the child, and verify that the requested home or upload path exists inside the chroot.
The client starts in an unexpected directory
Remember that sshd changes to the account’s home directory after chrooting. Ensure the home setting resolves to a directory inside the jail and that the directory exists. A path meaningful on the host before chroot may not exist after the root is changed.
An SSH command appears to run
Confirm that the account is actually matching the intended Match Group block and that no later configuration changes the policy. With ForceCommand internal-sftp, the client-supplied command is overridden. Re-test with both a bare SSH connection and an explicit command, and inspect sshd logs for the applied policy.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Forwarding still succeeds
Check each forwarding directive independently and verify that the account is in the restricted group. A chroot test does not test forwarding. Use a fresh connection after reloading and attempt TCP, agent, X11, and tunnel requests separately.
Logging fails inside the jail
An in-process SFTP session may still require the operating system’s logging endpoint inside the chroot. Consult the platform’s sshd and logging requirements and provide the required /dev/log path when logging is enabled. Do not add a full device tree merely because an SFTP-only jail does not need one.
How to verify that the jail is doing what you intend
- Identity: the account is a member of the dedicated group and is not unintentionally covered by another
Matchpolicy. - Path: the configured
ChrootDirectoryexpands to the intended per-user directory. - Hierarchy: every parent and the jail root meet the root-ownership and non-writable requirement.
- Home: the post-chroot home directory exists and opens at the expected location.
- Data permissions: writable content is below the jail root and has only the required account or group access.
- Protocol: SFTP listing and transfer operations work as designed.
- Shell and commands: interactive and command-mode SSH attempts do not provide arbitrary execution.
- Forwarding: every disallowed forwarding mode fails.
- Operations: logs show successful and rejected attempts clearly enough for later review.
Security boundaries worth explaining to users and administrators
A chroot is a session-level filesystem boundary, not a complete account-security model. The account still authenticates through the normal SSH mechanisms, and permissions inside the jail still govern what it can do with files. The safest design minimizes both the visible filesystem and the SSH capabilities available through the connection.
Keep the root-owned portion small and stable. Put changing data in clearly named children, document who owns those children, and review group membership when an employee, vendor, or automation job no longer needs access. If a workflow changes from upload-only to read/write, change the child-directory permissions deliberately rather than making the jail root writable.
Finally, treat a configuration reload as a change that requires a fresh verification pass. The daemon can accept syntactically valid settings while a path ownership mistake, missing home directory, or unintended Match scope prevents the intended session behavior.
A practical policy template
For a conventional transfer account, the policy can be expressed as follows:
- Use a dedicated Unix group and account.
- Resolve the account to a per-user jail such as
/srv/sftp/%u. - Keep every jail-path component root-owned and not writable by group or others.
- Place writable content in a child such as
/upload. - Force
internal-sftprather than allowing a shell or client-selected command. - Disable TCP, agent, X11, and tunnel forwarding unless a specific requirement has been approved.
- Validate configuration, reload while an administrative session remains open, and test SFTP, shell, command, forwarding, permissions, and logging behavior.
This combination answers the three practical goals behind most restricted-account requests: the user can transfer files, the user cannot browse the host outside the jail, and the SSH connection does not become an unexpected route to a shell or forwarded network access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
