Set Up SFTP with Chroot on Ubuntu 24.04

Create restricted group

The SFTP chroot setup on Ubuntu 24.04 starts by creating a restricted group named ‘chgroup’. This ‘chgroup’ group restricts users to accessing only the files and folders assigned to them. The ‘chgroup’ group is created, and users are added using commands like `groupadd chgroup` and `usermod -g chgroup username`.

Run the command below to create a new group.

sudo groupadd chgroup

Next, run the command below and put a user in the chgroup created above.

sudo usermod -aG chgroup username

Replace username in the command above with the account’s actual username.

Configure SSH

SSH configuration in Ubuntu 24.04 enables SFTP chroot. The SSH server’s main configuration file, `/etc/ssh/sshd_config`, is edited to set up SFTP connections. These changes restrict users to their own directories, as the chroot setup intends.

sudo nano /etc/ssh/sshd_config

Adjust the highlighted settings in the file.

# override default of no subsystems
# comment out the line below
#Subsystem      sftp    /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

# add the lines below
Match Group chgroup
    X11Forwarding no
    AllowTcpForwarding no
    ChrootDirectory /home
    ForceCommand internal-sftp

Save the file and then exit.

Restart SSH by running the command below.

Testing your SFTP chroot setup on Ubuntu 24.04 confirms that user access correctly restricts access. An SFTP connection is attempted to verify that users see only their assigned folders and cannot access other system parts. This testing step ensures your chroot configuration works as expected.

ssh richard@srv1.example.com's password:
This service allows sftp connections only.
Connection to srv1.example.com closed.

SFTP will succeed.

sftp richard@srv1.example.com's password:
Connected to srv1.example.com.
sftp>

The setup is complete!

Conclusion:

Setting up a chroot restricted SFTP account on Ubuntu 24.04 enhances security by isolating user access to specific directories. Here are the key takeaways:

• Enhanced Security: Users are confined to their directory, minimizing the risk of unauthorized access to other users’ files.
• Group Management: Creating a specific group for SFTP users simplifies the management of user permissions and access.
• SSH Configuration: Proper configuration in the SSH settings is crucial for implementing chroot restrictions effectively.
• Testing: Always test your configuration to ensure that SFTP works as intended without compromising security measures.

Creating a secure file transfer environment using SFTP with chroot is possible. This setup limits user access to specific directories, preventing them from seeing other files on your Ubuntu 24.04 server, which enhances security.