Set up SFTP by installing the OpenSSH server, creating a dedicated account, and applying an SSH Match rule. For a transfer-only account, use ForceCommand internal-sftp; for filesystem isolation, add ChrootDirectory and make its entire path root-owned and non-writable by group or other users.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The safest workflow is to keep an existing administrative SSH session open, validate the configuration with sshd -t, reload the service, and test SFTP from a second session before closing the first one.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What SFTP is on a Linux VPS
SFTP is the SSH File Transfer Protocol. In this setup it is provided by the existing OpenSSH service, not by a separate FTP daemon. OpenSSH supplies encrypted remote-control and file-transfer operations through the SSH service, so the same daemon can authenticate users, enforce account restrictions, and carry SFTP sessions.
An SFTP client connects to the server’s SSH port (normally TCP 22 unless your server uses another port). The server authenticates the account, starts the SFTP subsystem, and applies any global or per-user rules in /etc/ssh/sshd_config and its included snippets.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
There are two useful levels of restriction:
- Dedicated SFTP account: the account can transfer files but cannot obtain a normal shell when
ForceCommand internal-sftpis used. - Chrooted SFTP account: the session sees a selected directory as its filesystem root, preventing it from browsing paths above that directory.
A chroot is a filesystem boundary, not a complete security boundary for every possible server compromise. It is appropriate for limiting an ordinary transfer account’s view of the VPS, while the account’s SSH capabilities should still be reduced explicitly.
Choose the account model before changing SSH
| Model | Shell access | Paths visible to the account | Administration effort | Best fit |
|---|---|---|---|---|
| Regular SSH/SFTP user | Normal shell unless separately restricted | Normal filesystem permissions | Lowest | Trusted administrator or application account |
| SFTP-only user without chroot | No shell when forced to internal-sftp |
Any path readable by the account | Moderate | Transfers where filesystem visibility is acceptable |
| Chrooted SFTP-only user | No normal shell | Only the chroot tree | Highest; ownership and key-file placement must be exact | Untrusted or narrowly scoped file exchange |
The rest of this guide uses a dedicated group named sftpusers, a user named alice, and a jail at /srv/sftp/alice. Substitute your own names consistently. The commands shown are for Ubuntu; Fedora, RHEL, Alpine, and other distributions use different package and service names.
1. Confirm the VPS and preserve administrative access
Before editing SSH, record the VPS distribution image and the installed OpenSSH version. Directive availability and service names can vary by distribution and version.
Keep your current root or administrative SSH connection open throughout the change. Do not use it for experiments that could terminate your only working session. If a configuration error prevents new logins, that open session is your recovery path.
- Confirm that you can obtain administrative privileges with
sudo. - Identify the SSH service name used by the image; Ubuntu normally calls it
ssh. - Decide whether the new account will use a password, a public key, or keys only.
- Choose whether the account needs a chroot. A non-chrooted account is simpler to operate.
2. Install and start the OpenSSH server
On Ubuntu, install the server package and enable the service:
sudo apt update
sudo apt install openssh-server
sudo systemctl enable --now sshThe package supplies the SSH daemon, its SFTP subsystem, and the server configuration. If OpenSSH is already installed, the package command simply confirms the installed version and dependencies.
Do not copy these Ubuntu commands unchanged to another distribution. Use that distribution’s package manager and service name, then locate its equivalent sshd_config file and included configuration directory.
3. Create a dedicated SFTP account
A separate account makes file-transfer permissions auditable and prevents you from exposing an administrator’s shell credentials to a file-transfer client. Create a system group and an account whose login shell is nologin:
sudo groupadd --system sftpusers
sudo useradd --create-home --home-dir /srv/sftp/alice
--shell /usr/sbin/nologin --gid sftpusers aliceIf password authentication is part of your plan, set a password:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo passwd aliceOmit the password step when the account must use public-key authentication only. A nologin shell is an additional safeguard, but the SSH rule below is what forces an authenticated SSH session to run SFTP rather than a shell.
Build the chroot directory correctly
For a chrooted account, /srv/sftp/alice is the jail root. The user should not write to that directory. Create a child directory for transfers instead:
sudo mkdir -p /srv/sftp/alice/files
sudo chown root:root /srv /srv/sftp /srv/sftp/alice
sudo chmod 755 /srv /srv/sftp /srv/sftp/alice
sudo chown alice:sftpusers /srv/sftp/alice/files
sudo chmod 700 /srv/sftp/alice/filesThe ownership rule applies to every component of the path named by ChrootDirectory. The OpenSSH server rejects a jail when any component is writable by the group or by other users. The files directory is outside that rule because it is below the jail root and is intentionally writable by alice.
With this layout, an SFTP client generally starts in the jail root and uploads to /files. The server’s real /srv/sftp/alice path is represented as / inside the session.
4. Configure SSH keys for SFTP
Public-key authentication avoids sending a password and is the preferred method for automated transfers. On the client, create an Ed25519 key if you do not already have one:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →ssh-keygen -t ed25519Copy the public key to the account while password authentication is still available:
ssh-copy-id [email protected]Replace server.example with the VPS hostname or address. Test the key before turning off passwords.
Chroot layouts require special attention to the authorized-key file. A writable directory inside the jail is not a safe place for sshd to discover a key under normal strict-mode checks. Keep the authorized-key file outside the writable chroot, or set an explicit AuthorizedKeysFile path that the daemon can read before entering the chroot. Confirm the path and ownership rules on the installed distribution before disabling password authentication.
If key login fails, verify all of the following:
- The client is offering the intended private key.
- The public key is present in the file configured by
AuthorizedKeysFile. - The key file and its parent directories have the owner and modes required by
StrictModes. - The account is not locked or otherwise prevented from authenticating.
5. Add an SFTP-only Match block
Create a separate snippet when the distribution includes /etc/ssh/sshd_config.d/; otherwise append the block to /etc/ssh/sshd_config. For the example account group, use:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Match Group sftpusers
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
DisableForwarding yes
PermitTTY no
PasswordAuthentication yesWhat each directive does
Match Group sftpusersapplies the following settings to members of the dedicated group. It lets you add or remove SFTP accounts without duplicating the rule for every username.ChrootDirectory /srv/sftp/%usubstitutes the authenticated username for%u. Thusaliceis jailed at/srv/sftp/alice.ForceCommand internal-sftpignores a client’s request for a shell or an arbitrary command and starts the in-process SFTP server instead.DisableForwarding yesdisables unrelated forwarding features for these accounts.PermitTTY noprevents allocation of a terminal, which is unnecessary for file transfer.PasswordAuthentication yespermits passwords for this group when the global policy does not already prohibit them.
internal-sftp is especially useful with a chroot because it runs inside the SSH daemon and does not require support binaries or libraries inside the jail.
If your global policy already disables password authentication, remove the final line and use public-key authentication only. Conversely, do not add PasswordAuthentication yes casually if your security policy requires keys everywhere.
Mind the scope of Match
After a Match line, subsequent directives are interpreted in that conditional context. Do not place unrelated global directives after the block unless you begin another conditional reset with Match all. A misplaced directive can silently apply to the wrong accounts or cause a syntax error.
Check the manual installed with your OpenSSH version for directives such as DisableForwarding; older packages may not support every option. Remove or replace an unsupported directive only after confirming the version-specific alternative.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →6. Validate the configuration before reloading
Syntax-check the daemon while your administrative session remains open:
sudo sshd -tNo output normally means the syntax check passed. If an error is printed, correct the referenced file and line, then run the check again. Do not reload a configuration that has not passed validation.
Once validation succeeds, reload rather than stop and start the service:
sudo systemctl reload sshA reload makes the new policy available to new connections while preserving the existing administrative session. Keep that session open until the complete second-session test succeeds.
7. Test SFTP and verify that shell access is blocked
From another terminal, connect with an SFTP client:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sftp [email protected]At the sftp> prompt, verify the effective location and transfer permissions:
sftp> pwd
sftp> put test.txt
sftp> lsThe upload should succeed in the writable child directory. If the client starts at the jail root, change into /files before uploading, or configure the client to use that directory as its initial path.
Test the restrictions separately with an ordinary SSH connection:
ssh [email protected]The account should not receive a normal shell because ForceCommand internal-sftp runs the SFTP server instead. Check that the account cannot browse above its chroot. A successful file transfer and a rejected shell attempt are both required tests; testing only one leaves a major part of the policy unverified.
When a login or transfer fails, inspect the service log:
sudo journalctl -u sshSome distributions also write authentication events to a dedicated authentication log. Use the log message to distinguish a bad chroot mode, an authentication failure, and a subsystem or configuration problem.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteUnderstand the chroot permission rule
The most common chroot error is:
bad ownership or modes for chroot directoryOpenSSH checks every path component, not just the final directory. Inspect the complete path with:
namei -l /srv/sftp/aliceFor the example layout, /srv, /srv/sftp, and /srv/sftp/alice must be owned by root:root and must not be writable by group or other users. The user-owned /srv/sftp/alice/files directory is the place where uploads belong.
Permission denied while uploading
If authentication succeeds but put fails with Permission denied, check the destination directory rather than loosening the jail root:
- Confirm that the client is in
/files(or another intended child directory). - Confirm ownership with
ls -ld /srv/sftp/alice/files. - Ensure the directory grants
alicewrite and execute permission; the example uses mode700. - Do not make the chroot root writable as a shortcut. That causes the daemon’s ownership check to fail.
SFTP subsystem errors
If the client reports that the SFTP subsystem cannot start, inspect the configuration for a conflicting Subsystem sftp line and verify that the selected ForceCommand or subsystem is supported by the installed OpenSSH version. Run sshd -t after each change and review journalctl -u ssh for the server-side reason.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteKey authentication failures
Check the offered client key, the configured AuthorizedKeysFile path, ownership and modes, and the restrictions enforced by StrictModes. A key can be valid yet rejected because a parent directory is writable by another user or because the daemon cannot read the file before entering the chroot.
Recover from a lockout
If new administrative logins stop working, do not close the still-open session. Use it to restore the previous configuration or remove the new snippet, run:
sudo sshd -t
sudo systemctl reload sshThen correct the account, key, or permission issue and repeat the second-session test. If every session was closed, use the VPS provider’s console or recovery channel; do not assume a failed reload will repair itself.
Operational checks after setup
Once the first transfer works, verify the account’s complete operating envelope:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Upload a representative file and download it again.
- Confirm that the account can create, rename, and delete files only where intended.
- Attempt an SSH shell login and confirm it does not expose a shell.
- Attempt to reference a path outside the chroot and confirm it is not visible.
- Test the exact key or password policy that production clients will use.
- Review SSH logs after both successful and failed test attempts.
When adding another transfer account, create its own directory such as /srv/sftp/bob, make the directory root-owned, give the user a writable child directory, and add the user to sftpusers. The %u token keeps each account in its own matching jail.
When a non-chrooted account is the better choice
Chrooting is not mandatory for every SFTP deployment. A non-chrooted SFTP-only account avoids the strict root-ownership requirement and makes key-file placement and maintenance simpler. It is suitable when the account’s ordinary Unix permissions already provide an acceptable view of the filesystem, or when administrators need to troubleshoot and manage the account with fewer moving parts.
Choose the chrooted design when hiding paths outside the transfer area is itself a requirement. Accept the additional operational work: every jail component must remain correctly owned, the writable directory must be below the jail root, and authorized keys must be readable in the pre-chroot context.
Quick Recap
Final deployment checklist
- Confirm the VPS distribution, OpenSSH version, package manager, and service name.
- Keep an authenticated administrative SSH session open.
- Install and start the OpenSSH server package.
- Create a dedicated group and account rather than reusing an administrator.
- Decide whether passwords, keys, or keys only are allowed.
- For a chroot, make every jail component root-owned and not group/other-writable.
- Create a writable child directory owned by the SFTP user.
- Install and test the client’s public key before disabling passwords.
- Add the
Matchblock withForceCommand internal-sftp; add chroot and forwarding restrictions as required. - Run
sudo sshd -tand fix every error before reloading. - Reload the SSH service while the administrative session remains open.
- Test SFTP from a second session, then verify that ordinary SSH does not provide a shell.
- Use
namei -landjournalctl -u sshto diagnose permission and authentication failures.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
