Restricting File Transfers with Secure SFTP Chroot Jails

When managing a web server, you often need to grant developers, contractors, or content managers the ability to upload files. While standard FTP (File Transfer Protocol) transmits passwords in plain text and should never be used, its secure alternative, SFTP (SSH File Transfer Protocol), introduces a different security risk.

By default, any user with SFTP access to your server can also navigate backwards out of their designated upload folder. While file permissions might stop them from modifying core system files, they can still actively browse your /etc directory, view configuration structures, and potentially read sensitive application environments. To prevent this, you must configure a "Chroot Jail"—a security mechanism that locks the user into a specific directory, tricking their connection into believing that folder is the absolute root of the entire server.

Creating a Dedicated SFTP Group

Managing Chroot jails on a per-user basis becomes chaotic as your team grows. The most scalable and secure approach is to create a dedicated user group for restricted file transfers and apply the jail policies to the entire group.

• Connect to your server via SSH as a user with sudo privileges.

• Create a new group specifically for restricted users: sudo groupadd sftp_users.

• Create a new user (or modify an existing one) and add them strictly to this group, while completely disabling their ability to open a standard SSH terminal shell: sudo useradd -m -G sftp_users -s /bin/false web_contractor

• Set a password for the new user, or configure their SSH keys: sudo passwd web_contractor.

Configuring the SSH Daemon for Chroot

Because SFTP operates over the SSH protocol, the jail mechanism is managed directly by the SSH daemon. You need to instruct the server to intercept any connection from your new group and enforce the directory restriction.

• Open the main SSH configuration file: sudo nano /etc/ssh/sshd_config.

• Scroll to the absolute bottom of the file. (Rules using the Match directive must always be placed at the end of the file).

• Add the following configuration block:

  Plaintext

   

  Match Group sftp_users
      ChrootDirectory %h
      ForceCommand internal-sftp
      AllowTcpForwarding no
      X11Forwarding no
  

• ChrootDirectory %h: Tells the server to lock the user inside their home directory (%h).

• ForceCommand internal-sftp: Prevents the user from attempting to execute custom SSH commands, forcing the connection to exclusively use the built-in file transfer subsystem.

• AllowTcpForwarding no: Prevents the user from using their SFTP connection to create unauthorized network tunnels through your VPS.

Setting Strict Directory Permissions

This is where most Chroot configurations fail. For the SSH daemon to safely allow a Chroot jail, the exact directory acting as the jail (and all parent directories above it) must be owned by the root user and cannot be writable by anyone else. If these permissions are incorrect, the server will instantly drop the connection.

• Change the ownership of the user's home directory to root: sudo chown root:root /home/web_contractor

• Ensure the directory permissions are strict: sudo chmod 755 /home/web_contractor

• Because the contractor cannot write to their own root folder anymore, you must create a dedicated upload sub-directory inside the jail where they have full permissions: sudo mkdir /home/web_contractor/uploads

• Assign ownership of this specific sub-directory back to the contractor: sudo chown web_contractor:sftp_users /home/web_contractor/uploads

Testing the Jail

After configuring the user, the daemon, and the permissions, you must restart the SSH service and test the containment.

• Restart the SSH daemon to apply your new rules: sudo systemctl restart ssh.

• From your local machine, attempt to connect to the server using the restricted user: sftp web_contractor@your_server_ip

• Once logged in, type pwd (Print Working Directory). The server should report / instead of /home/web_contractor, confirming the user is jailed.

• Attempt to navigate up a directory by typing cd .. and then ls. You should still be trapped in the exact same folder.

• You can now safely instruct the user to navigate into the /uploads directory to begin transferring their files.