Updated: 11 October 2026 · Applies to: Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9
Ubuntu 16.04 and 18.04 are end of life. These steps create a user who can transfer files with SFTP but cannot open a shell, and who sees only their own folder. They work on Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9.
1. Create a group and user
groupadd sftpusers useradd -g sftpusers -s /usr/sbin/nologin -M sftpuser passwd sftpuser
2. Create the folder
The top folder (the "chroot") must be owned by root and not writable by the user; give the user a writable folder inside it:
mkdir -p /srv/sftp/sftpuser/upload chown root:root /srv/sftp/sftpuser chmod 755 /srv/sftp/sftpuser chown sftpuser:sftpusers /srv/sftp/sftpuser/upload
3. Configure SSH
Add this block at the end of /etc/ssh/sshd_config (a Match block applies to every line after it):
Match Group sftpusers
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
Check and restart: sshd -t && systemctl restart ssh (sshd on AlmaLinux/Rocky).
4. Test
Connect with sftp sftpuser@SERVER-IP or an SFTP client such as FileZilla. Files go into upload. An SSH login with the same user is refused.
Note: Password login must be allowed for this user. If PasswordAuthentication no is set (common on cloud images, often in /etc/ssh/sshd_config.d/), add PasswordAuthentication yes inside the Match block, or give the user an SSH key instead.
