How to Set up OpenSSH SFTP only with Chroot on Ubuntu 26.04

Before you start

You need an Ubuntu 26.04 server with OpenSSH Server installed and a Windows 11 PC on the same network. This article uses 192.0.2.10 as the server address and USERNAME as the restricted account. Replace both with your own values.

Keep your current SSH session open until the new login works in a second window. The steps below also back up the config first.

Create the group, the user and the folders

Create the SFTP-only group and user

A group lets you apply the restriction to more than one account later. The user gets /usr/sbin/nologin as its shell (a setting that blocks normal terminal logins).

1. Open a terminal on the Ubuntu server, or connect to it over SSH with an existing admin account.
2. Create the group (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo groupadd sftpusers

3. Create the user with no shell and no local home folder (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo useradd -g sftpusers -s /usr/sbin/nologin -M -d /files USERNAME

   The -d /files option is a path inside the chroot, so the user lands in a folder they can write to.
4. Set a password (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo passwd USERNAME

   Type the password twice. Ubuntu confirms with password updated successfully.

Build the chroot folder with the right ownership

OpenSSH refuses a chroot unless the chroot folder and every folder above it are owned by root. None of them can be writable by anyone else. The user gets a writable subfolder inside it.

1. Create the folders (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo mkdir -p /srv/sftp/USERNAME/files

2. Give root ownership of the chroot path (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo chown root:root /srv/sftp /srv/sftp/USERNAME

3. Set the permissions so only root can write there (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo chmod 755 /srv/sftp /srv/sftp/USERNAME

4. Give the user ownership of the writable subfolder (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo chown USERNAME:sftpusers /srv/sftp/USERNAME/files

Configure OpenSSH for SFTP only

Back up the config and add a drop-in file

Ubuntu reads extra settings from the /etc/ssh/sshd_config.d/ folder. A separate file keeps your change isolated, and deleting it undoes everything.

1. Back up the main config (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

2. Open a new file in the nano editor (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo nano /etc/ssh/sshd_config.d/50-sftp-chroot.conf

3. Paste these lines:

   💻Code

   Copy

   Match Group sftpusers
       ChrootDirectory /srv/sftp/%u
       ForceCommand internal-sftp
       AllowTcpForwarding no
       X11Forwarding no

   Here %u expands to the user's name, so each user gets their own chroot. ForceCommand internal-sftp runs the built-in SFTP server instead of a shell. The last two lines block port forwarding and X11 forwarding.
4. Press Ctrl+O, then Enter to save. Press Ctrl+X to exit.

Check the syntax and restart the service

1. Test the configuration (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo sshd -t

   No output means the syntax is valid. If you see an error, fix the file before you continue.
2. Restart the SSH service (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo systemctl restart ssh

Connect from 🪟 Windows 11

Windows 11 includes an OpenSSH client, so you need no extra software for a test.

Test the SFTP login

1. Right-click the Start button and select Terminal.
2. Connect to the server:

   💻Code

   Copy

   sftp USERNAME@192.0.2.10

3. Type yes if Windows asks you to trust the server's host key (its fingerprint) on first connection.
4. Enter the password. The prompt sftp> appears.
5. Type pwd to check your location. The server reports /, which is the chroot, not the real root of the server.
6. Type cd files to enter the writable folder.
7. Type put C:\Users\USERNAME\Documents\test.txt to upload a file. Type ls to confirm it is there.
8. Type exit to disconnect.

Confirm the account cannot open a shell

This check proves the restriction works.

1. In Terminal, run:

   💻Code

   Copy

   ssh USERNAME@192.0.2.10

2. Enter the password. The server answers This service allows sftp connections only. and closes the connection.

Use a graphical client instead

WinSCP and FileZilla also work. In either one, choose SFTP as the protocol and enter 192.0.2.10 as the host. Use port 22, then sign in with USERNAME and its password.

Common problems

• "Broken pipe" or the connection closes right after login: the chroot ownership is wrong. Check that /srv/sftp and /srv/sftp/USERNAME are owned by root and not writable by the group or others. Review the log with sudo journalctl -u ssh.
• "Permission denied" when uploading: you are at the top level of the chroot, which is read-only for the user. Change into the files folder first.
• Login fails with a correct password: confirm the user belongs to the group with id USERNAME.

Undo the change

These steps remove the SFTP-only restriction.

1. Delete the drop-in file (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo rm /etc/ssh/sshd_config.d/50-sftp-chroot.conf

2. Restart the service (requires administrator rights):

   🐧Bash / Shell

   Copy

   sudo systemctl restart ssh

The user and folders stay on the server until you remove them, but the account is no longer restricted to SFTP.

What to do next

Password logins are the weak point of this setup. Switch the SFTP account to SSH key pair authentication, and keep it in the sftpusers group so the chroot still applies. To add more SFTP-only users, repeat the user and folder steps. The existing Match Group block already covers them.