How to Create SFTP User without Shell Access on Ubuntu 18.04 & 16.04?

Updated: 28 September 2026 · Applies to: Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9

Ubuntu 16.04 and 18.04 are end of life. These steps create a user who can transfer files with SFTP but cannot open a shell, and who sees only their own folder. They work on Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9.

1. Create a group and user

groupadd sftpusers
useradd -g sftpusers -s /usr/sbin/nologin -M sftpuser
passwd sftpuser

2. Create the folder

The top folder (the "chroot") must be owned by root and not writable by the user; give the user a writable folder inside it:

mkdir -p /srv/sftp/sftpuser/upload
chown root:root /srv/sftp/sftpuser
chmod 755 /srv/sftp/sftpuser
chown sftpuser:sftpusers /srv/sftp/sftpuser/upload

3. Configure SSH

Add this block at the end of /etc/ssh/sshd_config (a Match block applies to every line after it):

Match Group sftpusers
    ChrootDirectory /srv/sftp/%u
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

Check and restart: sshd -t && systemctl restart ssh (sshd on AlmaLinux/Rocky).

4. Test

Connect with sftp sftpuser@SERVER-IP or an SFTP client such as FileZilla. Files go into upload. An SSH login with the same user is refused.

Note: Password login must be allowed for this user. If PasswordAuthentication no is set (common on cloud images, often in /etc/ssh/sshd_config.d/), add PasswordAuthentication yes inside the Match block, or give the user an SSH key instead.