On this tutorial I will show how to create SFTP accounts limited to a single directory. The SFTP account can be assigned to a single user or to groups. I will cover both situations on this tutorial.

The first thing we need is to install openssh:
sudo apt-get install openssh-server

Create the user

For creating the user just run the following command:
sudo adduser Billy

Prevent user from accessing ssh

To increase security, the user shouldn’t be allowed to use ssh:
sudo usermod -s /bin/false Billy

Configure ssh

Now we need to modify the ssh configuration on file /etc/ssh/sshd_config replacing the following line:
Subsystem sftp /usr/lib/openssh/sftp-server

By this one:

Subsystem sftp internal-sftp

internal-sftp is much newer than sftp-server, The sftp-server is still the default option for backward compatibility. Nevertheless internal-sftp supports all sftp-server features and also limiting access to users and groups. Furthermore it has better performance, because it doesn’t need to run new processes for SFTP.

Setup user’s default root path

We need to set user’s default path to the root directory: “/”
sudo usermod -d / Billy
This is necessary because the path that will be defined on “ChrootDirectory” will be relative to this root path.

Setup the SFTP folder

The “ChrootDirectory” folder must be owned by root:
sudo chown root.root /PATH/TO/THE/FOLDER/WITH/SFTP/ACCESS

Create limited account for a single user

Go to the end of the file sshd_config and add these lines:

Match User Billy
	ChrootDirectory /PATH/TO/THE/FOLDER/WITH/SFTP/ACCESS
	PermitTunnel no
	X11Forwarding no
	AllowTcpForwarding no
	ForceCommand internal-sftp

Be careful with the command ForceCommand internal-sftp it will force the user to connect only by sftp, the ssh access will be disabled!

Note.- You can also add PasswordAuthentication yes to allow password authentication, then you should add a password to your user sudo passwd Billy. If this option is disabled you will need to use RSA keys instead.

Create limited account for a group

Create the group:
sudo addgroup sftplimited

Add user to group:
sudo usermod -g sftplimited Billy

Now go to the end of the file sshd_config and add these lines:

Match group sftplimited
	ChrootDirectory /PATH/TO/THE/FOLDER/WITH/SFTP/ACCESS
	PermitTunnel no
	X11Forwarding no
	AllowTcpForwarding no
	ForceCommand internal-sftp

Be careful with the command ForceCommand internal-sftp it will force this group to connect only by sftp, the ssh access will be disabled!

Note.- You can also add PasswordAuthentication yes to allow password authentication, then you should add a password to your user sudo passwd Billy. If this option is disabled you will need to use RSA keys instead.

Try it out

Restart ssh service to load all changes:
sudo service ssh restart

Try the SFTP connection:
sftp [email protected]

Problems?

If it doesn’t work for some reason, try to run ssh in debug mode (you will see errors on console):
/usr/sbin/sshd -ddd