Set Up a Secure SFTP File Server on Linux (chroot)

A file server lets people upload and download files remotely. The safest simple option on Linux is an SFTP file server built into OpenSSH: traffic is encrypted, no extra software is needed, and users can be locked into their own folders with a chroot jail. This guide sets that up and explains when other file server protocols fit better.

Before you start

A Linux VPS (Ubuntu, Debian, AlmaLinux or Rocky) with root access and OpenSSH installed.
An open SSH port in the firewall.
Keep a root SSH session open while you edit SSH settings.

File server protocols compared

Protocol	Encrypted	Best for
SFTP (over SSH)	Yes	Uploads over the internet, website files
FTPS (FTP over TLS, e.g. vsftpd)	Yes, if forced	Legacy clients that only speak FTP
Plain FTP	No	Avoid on the internet
SMB/Samba	Optional	Windows file shares on a private network or VPN
NFS	Not by default	Linux-to-Linux shares inside a private network

Never expose Samba or NFS directly to the internet – use them over a VPN such as WireGuard.

Create a group and user for SFTP

Create a group for SFTP-only users:
```
sudo groupadd sftpusers
```
Create a user with no shell access:
```
sudo useradd -m -g sftpusers -s /usr/sbin/nologin alice && sudo passwd alice
```
On some systems the nologin path is /sbin/nologin.

Prepare the chroot folder

OpenSSH requires the chroot directory and every folder above it to be owned by root and not writable by others. So give the user a writable subfolder inside it:

sudo mkdir -p /srv/sftp/alice/upload
sudo chown root:root /srv/sftp /srv/sftp/alice
sudo chmod 755 /srv/sftp /srv/sftp/alice
sudo chown alice:sftpusers /srv/sftp/alice/upload

Configure OpenSSH

Create /etc/ssh/sshd_config.d/sftp.conf with:

Subsystem sftp internal-sftp

Match Group sftpusers
    ChrootDirectory /srv/sftp/%u
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no
    PasswordAuthentication yes

If /etc/ssh/sshd_config already has a Subsystem sftp line, comment it out so there is only one.
Test and restart:
```
sudo sshd -t && sudo systemctl restart ssh
```
Use sshd as the service name on AlmaLinux/Rocky.

For better security, set PasswordAuthentication no in the Match block and give each user an SSH key in their home directory's .ssh/authorized_keys instead.

Test the connection

From your computer: sftp alice@your-server-ip, or use FileZilla/WinSCP with protocol SFTP on port 22.
Run ls – you should only see upload.
Confirm shell login is refused: ssh alice@your-server-ip should close immediately.

SELinux note (AlmaLinux/Rocky)

If logins fail with SELinux enforcing, check /var/log/audit/audit.log; enabling setsebool -P ssh_chroot_rw_homedirs on may be needed for chrooted home directories.

Troubleshooting

"broken pipe" or connection closed right after login: the chroot path is not owned by root or is group-writable. Check with ls -ld /srv/sftp /srv/sftp/alice and journalctl -u ssh.
Permission denied when uploading: the user is writing to the chroot root instead of upload, or upload has the wrong owner.
sshd -t errors: duplicate Subsystem lines or a typo in the Match block.

FAQ: SFTP file server

Is SFTP the same as FTPS?

No. SFTP runs over SSH on one port; FTPS is classic FTP wrapped in TLS and uses several ports.

Can I give a website's developer SFTP on cPanel hosting?

On shared hosting, use cPanel's FTP accounts or SSH access features instead of editing server config.

How do I limit how much a user can upload?

Use filesystem quotas or put their folder on a separate volume with a fixed size.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket