Set Up SFTP with Chroot on Ubuntu 24.04

Create restricted group

The first job is a dedicated group for the users you want to restrict. The SSH rules you write later apply to this group, not to individual names. Any account you add to the group is jailed automatically, and removing an account from the group lifts the restriction. That makes it much easier to manage than editing the SSH config for every new user.

You create the group with the groupadd command and then add your chosen user account to it. Run the commands from a terminal as a user with sudo rights.

1. Open a terminal on the server.
2. Run the command below to create the new group.

sudo groupadd chgroup

If the command succeeds, it prints nothing and returns you to the prompt. That is normal on Linux. If you see a message that the group already exists, the group is already there and you can go on to the next step.

3. Add an account to the new group with the command below.

sudo usermod -aG chgroup username

Again, no output means the command worked. Group changes apply to the user the next time they log in, so this is fine for accounts that are not currently connected.

Substitute username in the command above with the actual account name. If the account does not exist yet, create it first, then add it to the group. To undo this later, remove the user from the group and they go back to normal SSH access, if their account allows it.

Configure SSH

Next, tell the SSH server to apply the restricted-folder rules to your new group. You do this in the main server settings file, /etc/ssh/sshd_config, which you must open with administrative rights. You will change the subsystem line that handles SFTP and add a match block for the group.

The match block is what limits the rules to your group. Everything under it applies only to members of that group, so other users, including you as admin, keep their normal SSH behavior. The block normally also sets the jail folder and forces internal SFTP, which gives these users file transfer only and no shell.

Before you edit, it is smart to make a backup copy of the file so you can roll back if something goes wrong.

1. Open /etc/ssh/sshd_config in a text editor with sudo, using the command below.

sudo nano /etc/ssh/sshd_config

The file opens in the editor. It is long and mostly comments, so scroll through it and find the existing SFTP subsystem line.

2. Adjust the highlighted settings in the file. Change the subsystem line and add the match block for your group, as shown below.

# override default of no subsystems
# comment out the line below
#Subsystem      sftp    /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

# add the lines below
Match Group chgroup
    X11Forwarding no
    AllowTcpForwarding no
    ChrootDirectory /home
    ForceCommand internal-sftp

Two things matter here. Keep the match block at the very end of the file, because it applies to every line after it until the next match block. Also, use the group name you created earlier, exactly as you typed it.

The folder you set as the jail has one strict rule. It must be owned by root and must not be writable by the group or by others. If it is not, SSH refuses the login. Users cannot write to the jail folder itself, so give each one a subfolder inside it that they own.

3. Save your changes and close the editor.

4. Restart the SSH daemon to apply the new rules.

Keep your current SSH session open while you do this. Existing sessions stay connected after a restart, so if you made a typo in the config you can still get in and fix it. If the restart reports an error, reopen the file and check the lines you changed.

Now test the connection to make sure the sandbox works. Do the test from another computer, or from a second terminal, and log in as the restricted user over SFTP. Do not hand access to real users until this works.

When the jail is working, you should see only the jail folder and whatever sits inside it. Try to move up with a parent-folder command. You should stay at the top of the jail and never see directories like /etc or /home. A normal SSH login with this account should also be refused if you forced internal SFTP.

ssh richard@srv1.example.com's password:
This service allows sftp connections only.
Connection to srv1.example.com closed.

If the connection drops right after you enter the password, the usual cause is the ownership rule above. The jail folder must be owned by root and not writable by others. Check the SSH log on the server for a message about bad ownership or modes for the chroot directory, fix the permissions, and try again.

SFTP connections succeed, and the user sees only their jailed folder. If you also try uploading a test file into the writable subfolder, you will know the permissions are right for real use.

sftp richard@srv1.example.com's password:
Connected to srv1.example.com.
sftp>

The configuration process finishes here. To add more restricted users later, create the account and add it to the same group. The existing SSH rules will cover them without another edit to the config file.

Conclusion:

Isolating users inside a chroot sandbox hardens server security. Review these key takeaways from the setup:

• Enhanced Security: Users are confined to their directory, minimizing the risk of unauthorized access to other users' files.
• Group Management: Creating a specific group for SFTP users simplifies the management of user permissions and access.
• SSH Configuration: Proper configuration in the SSH settings is crucial for implementing chroot restrictions effectively.
• Testing: Always test your configuration to ensure that SFTP works as intended without compromising security measures.

Locking down file transfers with a chroot jail protects sensitive host directories. Maintaining strict user boundaries keeps the Ubuntu 24.04 server secure against unauthorized file inspection.