When managing enterprise applications or setting up secure drop zones for external vendors, giving full SSH access to a Linux server is a major security risk. A safer, industry-standard approach is to configure a Secure File Transfer Protocol (SFTP) server restricted to a chroot jail. This locks users into their designated directory, preventing them from navigating the rest of your file system or obtaining an interactive terminal shell.

This step-by-step guide walks you through setting up a dedicated SFTP environment on Linux, configuring OpenSSH security rules, avoiding common configuration errors, and connecting seamlessly using an FTP client like WinSCP.

Step 1: Create a Dedicated SFTP Group and User

To manage permissions cleanly, create a dedicated user group for SFTP clients. This allows you to apply bulk security rules to all members via the SSH daemon configuration.

  1. Create the SFTP group:

    Bash

    sudo groupadd sftpusers

  2. Create the SFTP user and assign restrictions:

    Bash

    sudo useradd -m -g sftpusers -s /usr/sbin/nologin sftpuser

    • -m: Automatically creates the user's home directory.

    • -g sftpusers: Assigns the user to the SFTP group.

    • -s /usr/sbin/nologin (or /bin/false): Strips away interactive terminal shell access, ensuring the user can only perform file transfers.

  3. Set a secure password for the user:

    Bash

    sudo passwd sftpuser

Step 2: Configure Directory Permissions (The Chroot Rule)

OpenSSH enforces strict security requirements for chroot directories. The root chroot directory and all of its parent directories must be owned by root and must not be writable by any other user or group.

If a chroot directory is writable by the user, the connection will immediately abort with a Software caused connection abort error.

  1. Create the main chroot mount point:

    Bash

    sudo mkdir -p /var/sftp

  2. Lock down the root chroot directory ownership and permissions:

    Bash

    sudo chown root:root /var/sftp
sudo chmod 755 /var/sftp

  3. Create a writable subdirectory for file uploads: Since the root chroot folder (/var/sftp) cannot be writable by the user, you must create a subdirectory inside it where files can actually be deposited (e.g., BankFiles):

    Bash

    sudo mkdir -p /var/sftp/BankFiles
sudo chown sftpuser:sftpusers /var/sftp/BankFiles
sudo chmod 755 /var/sftp/BankFiles

Step 3: Configure the SSH Daemon (sshd)

Next, tell the SSH daemon to intercept any login attempts from members of the sftpusers group and lock them into the chroot jail using internal SFTP.

  1. Open the SSH configuration file:

    Bash

    sudo nano /etc/ssh/sshd_config

  2. Scroll to the very bottom of the file and append the following Match block:

    Plaintext

    Match Group sftpusers
    ChrootDirectory /var/sftp
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTcpForwarding no

    • Note: Ensure global parameters like UsePAM or general directives are placed at the top of the file, never inside or below a Match block. Make sure the lines are uncommented.

  3. Validate and restart the SSH service:

    Bash

    sudo sshd -t
sudo systemctl restart ssh

    (The sshd -t command checks your configuration file for syntax errors before restarting, preventing accidental lockouts).

Step 4: Connecting via WinSCP

With the server-side configuration complete, you can now connect securely from a Windows machine using WinSCP.

  1. Open WinSCP and click New Session.

  2. Set the File protocol to SFTP (this automatically defaults the port to 22).

  3. Enter your Host name (Linux server IP address or domain).

  4. Enter your credentials:

    • User name: sftpuser

    • Password: The password you defined in Step 1.

  5. Click Login. On your first connection, accept the host key fingerprint.

Because the user is jailed to /var/sftp, WinSCP will land directly in that root directory, where your writable BankFiles/ folder will be immediately accessible for file transfers.

Conclusion

By combining OpenSSH's built-in internal-sftp subsystem with a properly permissioned ChrootDirectory, you have established a robust, secure, and isolated file transfer environment. This setup ensures that external partners or internal applications can move files safely without ever exposing your core operating system shell.