Set Up SFTP with Chroot on Ubuntu 24.04

Create restricted group

Creating a dedicated group for SFTP chroot Ubuntu 24.04 lets you lock users down to their home folders so they cannot roam around the rest of your file system. You can set up this restricted access by adding a new user group using the groupadd command and then putting your chosen user account into it.

Run the command below to create a new group.

sudo groupadd chgroup

Next, add an account to the new group.

sudo usermod -aG chgroup username

Substitute username in the command above with the actual account name.

Configure SSH

Configuring SSH for SFTP chroot Ubuntu 24.04 requires editing the main server settings file to turn on the restricted folder rules for your new user group. You need to open the /etc/ssh/sshd_config file with administrative rights and update the subsystem and match block settings.

sudo nano /etc/ssh/sshd_config

Adjust the highlighted settings in the file.

# override default of no subsystems
# comment out the line below
#Subsystem      sftp    /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

# add the lines below
Match Group chgroup
    X11Forwarding no
    AllowTcpForwarding no
    ChrootDirectory /home
    ForceCommand internal-sftp

Save changes and close the editor.

Restart the SSH daemon to apply the new rules.

Test the connection to verify that the sandbox functions correctly. Attempt an SFTP login to confirm the restricted directory view prevents wandering into unauthorized areas. Verification ensures the configuration works before handing access over to real users.

ssh richard@srv1.example.com's password:
This service allows sftp connections only.
Connection to srv1.example.com closed.

SFTP connections succeed.

sftp richard@srv1.example.com's password:
Connected to srv1.example.com.
sftp>

The configuration process finishes here.

Conclusion:

Isolating users inside a chroot sandbox hardens server security. Review these key takeaways from the setup:

• Enhanced Security: Users are confined to their directory, minimizing the risk of unauthorized access to other users' files.
• Group Management: Creating a specific group for SFTP users simplifies the management of user permissions and access.
• SSH Configuration: Proper configuration in the SSH settings is crucial for implementing chroot restrictions effectively.
• Testing: Always test your configuration to ensure that SFTP works as intended without compromising security measures.

Locking down file transfers with a chroot jail protects sensitive host directories. Maintaining strict user boundaries keeps the Ubuntu 24.04 server secure against unauthorized file inspection.