Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSSH login does not grant automatic access to any directory. After authentication, Linux checks the account’s UID, supplementary groups, directory and file mode bits, ACLs, and execute permission on every parent directory. For a reusable shared folder, put the account in a dedicated group, assign that group to the directory, and use setgid permissions. Use an ACL when only one account needs access, or a root-owned chroot with a writable child directory for an SFTP-only account.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What Linux checks after an SSH login
OpenSSH authenticates a normal Linux account; it does not create a separate permission system for SSH. The logged-in process runs with that account’s UID and supplementary groups. Linux then evaluates the requested operation against the path’s owner, group, “other” mode bits, any access-control lists, and the permissions on each directory leading to the target.
As an Amazon Associate I earn from qualifying purchases.
| Permission | On a directory | On a regular file |
|---|---|---|
Read (r) |
Read the directory’s entry names, which is what allows a listing when combined with execute permission. | Read the file’s contents. |
Write (w) |
Create, remove, or rename entries, provided execute permission also permits access to the directory. | Change the file’s contents. |
Execute (x) |
Traverse the directory and access an item whose name is known. | Run the file as a program or script, subject to other system controls. |
A user therefore needs execute permission on every parent directory. A perfectly permissioned /srv/shared/incoming is still unreachable if the account cannot traverse /srv or /srv/shared. Directory read without execute usually cannot be used to open the listed files; execute without read permits access to known names but not a normal listing.
Choose the access design before changing permissions
| Requirement | Best fit | Boundary and trade-off |
|---|---|---|
| Several trusted accounts need the same read-only share | Dedicated Unix group with directory mode 2750 |
Simple to operate; members receive the group’s read and traversal rights. |
| Several trusted accounts must create or modify entries | Dedicated group with mode 2770 |
Group members can write in the directory; membership must be maintained carefully. |
| One account needs access without changing the directory’s main group | POSIX ACL | Precise per-user grant; ACL masks must not silently reduce the requested rights. |
| Transfer-only access with no shell or forwarding | internal-sftp in a Match User chroot |
Strong isolation, but the chroot boundary must be root-owned and a separate child directory must be writable. |
| Interactive shell access to an unrestricted path | Normal Unix permissions or ACLs | More flexible than a jail, but the user can use every command allowed by the account. |
Grant access with a dedicated group
1. Inspect the account and path
Confirm the login name and examine the path before changing anything:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
id sshuser
namei -l /srv/sharedid shows the UID and current supplementary groups. namei -l prints each path component and its owner and mode, making a missing traversal permission visible. Check whether the target is a directory and identify its current owner and group with your normal file-management tools.
2. Create the group and add the SSH account
sudo groupadd folderusers
sudo usermod -aG folderusers sshuserThe -aG form appends the new group; omitting -a can replace the user’s existing supplementary-group list. If the group already exists, skip groupadd and add the user to the existing group.
3. Assign the directory to the group
sudo chown -R owner:folderusers /srv/sharedThis makes owner the owner and folderusers the group for the entire tree. Do not use recursive ownership changes if unrelated subdirectories intentionally belong to different owners; in that case, change only the intended directory or use an ACL.
4. Set directory permissions and setgid inheritance
For a read-only group share, use:
sudo chmod 2750 /srv/sharedThe leading 2 is the setgid bit. New entries created inside the directory inherit its group instead of the creator’s primary group. The remaining digits give the owner read, write, and traverse rights; the group read and traverse rights; and no rights to others.
For a group that must upload, create, rename, or remove entries, use:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo chmod 2770 /srv/sharedThat grants the group read, write, and traverse rights. Write permission on a directory controls its entries, so a member can remove or rename a file even when the file itself is not writable by that member. Apply file and directory modes separately when changing a whole tree. A blanket recursive directory mode can accidentally make ordinary files executable or remove needed file-write permissions; preserve suitable file modes and use directory-specific modes for directories.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →5. Start a new login session
Supplementary groups are normally collected when the session starts. After usermod -aG, disconnect and establish a fresh SSH or SFTP session. Check the result with:
id sshuserIf the new group is absent, the old session is still carrying its previous group list.
6. Test the effective rights as the target account
sudo -u sshuser -- test -x /srv/shared
sudo -u sshuser -- test -r /srv/shared/file
sudo -u sshuser -- test -w /srv/shared/incomingThese tests isolate traversal, reading, and writing. Test the exact child directory used by the application or SFTP client, not only its parent. A user may be able to traverse the share while lacking write permission in a particular subdirectory.
Grant one account access with ACLs
ACLs are useful when changing the directory’s primary group would affect other applications or users. Grant only the rights required:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo setfacl -m u:sshuser:rx /srv/shared
sudo setfacl -m u:sshuser:rwx /srv/shared/incomingThe first entry permits reading and traversing the share; the second permits full directory operations in incoming. The user still needs execute permission on every parent directory above /srv/shared.
Inspect the resulting ACL, including its effective mask, with:
getfacl /srv/shared /srv/shared/incomingThe ACL mask limits the effective permissions of named users and groups. If getfacl shows a requested entry but an effective permission after the mask is narrower, adjust the mask deliberately rather than assuming the named entry wins. Keep ACL changes scoped to the intended directories, and decide whether newly created children need their own default ACL policy; a grant on one directory does not automatically make every future child writable.
Why “permission denied” persists
The account cannot traverse a parent
Run namei -l /srv/shared/incoming and inspect each component. The target may show rwx for the account while /srv or an intermediate directory lacks group or ACL execute permission. Add the smallest traversal grant needed on the parent; do not expose directory listings broadly just to solve a path problem.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The session has stale group membership
If id sshuser in the existing session does not show folderusers, start a new SSH connection. Changing /etc/group or running usermod does not retroactively alter processes that are already logged in.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
An ACL mask narrows the grant
Use getfacl to compare the named-user or named-group entry with the “effective” permission reported beside it. A restrictive mask can turn an apparent rwx grant into read-only or traversal-only access.
The operation needs directory write permission
Uploading a new file, deleting an entry, and renaming an entry require write and execute permission on the containing directory. Read permission on the destination file is irrelevant to creating a new upload. Conversely, editing an existing file requires write permission on that file as well as traversal through its parent directories.
The test uses a different account
Test with sudo -u sshuser, not as root and not as your administrator account. Root can bypass ordinary mode checks, so a successful root test does not prove that the SSH user can perform the same operation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keep SSH key authentication itself correctly permissioned
OpenSSH normally reads .ssh/authorized_keys relative to the user’s home directory unless AuthorizedKeysFile is overridden. The home directory, .ssh directory, and authorized_keys file should be owned appropriately and not writable by unrelated users.
With StrictModes enabled, sshd can refuse to use a key when those locations have unsafe ownership or modes, even if the shared folder’s permissions are correct. This failure occurs before the account attempts to access /srv/shared. Check the SSH daemon’s authentication diagnostics separately from filesystem tests, and keep private key material accessible only to the account that owns it.
Build an SFTP-only account with a chroot
Use a chroot when the account should transfer files but must not receive an interactive shell, terminal, or forwarding. Add a user-specific block to the SSH daemon configuration:
Match User sshuser
ForceCommand internal-sftp
ChrootDirectory /srv/sftp/%u
DisableForwarding yes
PermitTTY noForceCommand internal-sftp replaces the requested shell command with the in-process SFTP server. DisableForwarding yes prevents forwarding features for this match, and PermitTTY no prevents allocation of a terminal. The %u token expands to the login name, so the example expects a directory such as /srv/sftp/sshuser.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Make the chroot boundary safe
The chroot directory and every component above it must be owned by root and must not be writable by any other user or group. OpenSSH checks this boundary; if it is group- or user-writable, it rejects the chroot configuration rather than treating it as a safe jail.
Do not make the chroot root writable merely to enable uploads. Create a child directory for data, for example /srv/sftp/sshuser/incoming, and grant the account ownership or an ACL on that child. The account can then upload below incoming while the chroot boundary remains protected.
Understand the two common chroot failures
- Authentication fails or the session is closed: a chroot component is not root-owned or is writable by group or others.
- Authentication succeeds but uploads fail: the chroot is correctly protected, but no child directory grants the account write and execute permission.
Validate before applying the configuration
Run the daemon’s syntax check before reloading it:
sudo sshd -tOnly reload the SSH service after that check succeeds. Keep an existing administrative session open while testing a new SFTP connection so a configuration error does not remove your recovery path.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesVerification checklist for the actual client operation
- Confirm the intended identity with
id sshuser, including supplementary groups. - Inspect every path component with
namei -l /srv/shared/incomingor the corresponding chroot child path. - Inspect ACL entries and masks using
getfaclwhenever ACLs are present or the mode bits do not explain the result. - Run read, write, and execute checks as the target account with
sudo -u sshuser -- test .... - After group changes, open a fresh SSH session. Then test the real operation with
ssh -vvor an SFTP client so authentication, path selection, and transfer permissions are all exercised.
Use the least powerful design that meets the requirement: a group for a stable shared audience, an ACL for a narrow exception, and an SFTP chroot when the account should be confined to file transfer. Keep parent traversal explicit, separate directory permissions from file permissions, and verify effective rights as the same account that will connect.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
