iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
By default, an SFTP session starts in the account’s operating-system home directory. To make a user land somewhere else, change that home-directory setting. If the user must be unable to see the rest of the server, add an SFTP chroot: ChrootDirectory changes the visible filesystem root, and sshd then starts in the user’s home path inside that jail. For SFTP-only access, pair the jail with ForceCommand internal-sftp.
Choose the control that matches your goal
“Default directory” can mean two different things. A home-directory change affects where the session starts, while a chroot changes what the account can see. They are often configured together, but they solve different problems.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute| Goal | Setting | What the user experiences | Isolation |
|---|---|---|---|
| Start in another directory | Account home directory | The user begins in the configured home path. | None beyond normal filesystem permissions |
| Hide the rest of the filesystem | ChrootDirectory |
The configured path becomes the user’s filesystem root. | Filesystem jail when ownership and permissions are correct |
| Allow file transfer without a shell | ForceCommand internal-sftp |
The SSH session runs the in-process SFTP server instead of a shell command. | Usually combined with a chroot for SFTP-only accounts |
| Choose an SFTP start/upload directory through the subsystem | -d on sftp-server |
The subsystem starts in the directory specified by that option. | Does not by itself create a filesystem jail |
The key path rule is easy to miss: after a chroot, the user’s home directory is interpreted inside the jail. If the jail is /srv/sftp/alice and the account home is /upload, the effective location is /srv/sftp/alice/upload. Setting the home to the host’s full path, such as /srv/sftp/alice/upload, would look for that path inside the jail and usually produce a missing-directory or login error.
Linux: change only the starting directory
Use this approach when the account may continue to use ordinary SSH features and should merely start in a different place.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
- Create the destination directory and apply the normal Linux ownership and permissions required by the account.
- Use the user-management tool supplied by your distribution to set the account’s home directory to that destination. The exact command and options differ between distributions, so do not copy a command intended for another platform without checking its local documentation.
- Confirm the resulting account record with a system account lookup, for example
getent passwd alice. The home-directory field should contain the path you intend to use. - Open a new SFTP connection. Existing sessions keep their current working directory; the new setting is observed on the next login.
Leaving ChrootDirectory unset means the user still has the normal server filesystem view, limited only by ordinary Unix permissions. A home-directory change is therefore a convenience setting, not a security boundary.
Linux: create a jailed, SFTP-only account
A common OpenSSH configuration uses a per-user Match block:
Match User alice
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
X11Forwarding no
AllowTcpForwarding no%u is replaced by the authenticated username, so Alice’s jail becomes /srv/sftp/alice. Restricting the block to a user keeps the policy from unintentionally affecting every SSH account. You can target a group instead when several accounts need exactly the same treatment.
1. Build the chroot path
- Create the parent and user-specific jail, for example
/srv/sftp/alice. - Make the jail directory and every component above it owned by
rootand not writable by the SFTP user, its group, or other users. OpenSSH rejects an unsafe chroot with errors such as “Bad ownership or modes.” - Inside the jail, create a separate writable directory such as
/srv/sftp/alice/upload. - Give the SFTP account ownership of that writable directory, or grant it the narrowly scoped write permissions it needs. Do not make the jail root itself writable.
The split between a protected jail root and a writable child is intentional. The daemon must be able to trust the directory that becomes the new filesystem root, while the user still needs somewhere to upload, rename, and delete files.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
2. Set the account home path inside the jail
Use your distribution’s account-management tool to set Alice’s home directory to /upload. This path is relative to the chroot at login. The resulting mapping is:
| Configuration item | Value | Meaning |
|---|---|---|
| Host-side jail | /srv/sftp/alice |
Directory that becomes the filesystem root |
| Account home field | /upload |
Initial working directory inside that root |
| Effective host-side location | /srv/sftp/alice/upload |
Writable directory reached after login |
Do not put the host-side absolute path in the account’s home field when a chroot is active. Inside the jail, the user cannot see the original /srv tree.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →3. Configure the SFTP subsystem and policy
Ensure the global Subsystem sftp declaration points to an available sftp-server binary, or use the in-process internal-sftp implementation. The ForceCommand internal-sftp line in the user block forces an SFTP session even if the client requests another SSH command. Disabling X11 and TCP forwarding removes features that an SFTP-only account does not need.
Place the user or group block where it will be applied as intended. In OpenSSH configuration, settings inside a Match block remain conditional until another Match directive or the end of the file, so review any lines that follow it.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
4. Validate before applying the change
- Run
sshd -tas the platform administrator. This checks the configuration syntax without starting a new session. - If validation reports an error, fix the indicated directive, path, or permission issue and run the check again.
- Only after validation succeeds, reload or restart the SSH service using your distribution’s service manager.
- Keep an already-open administrative SSH session until a fresh SFTP login has been tested. This gives you a recovery path if the new policy prevents access.
5. Test the complete behavior
Connect with a new SFTP session as Alice and check that the initial directory is shown as /upload (or the client’s equivalent representation). Upload a small test file, list it, rename it, and remove it if those operations are part of the account’s intended role. Try moving to the parent with cd ..; in a correctly functioning chroot, the user remains within the jail rather than reaching the host filesystem. Also verify that an interactive SSH shell is not available if the account is intended to be SFTP-only.
Linux: common configuration mistakes
Using a writable chroot root
Making /srv/sftp/alice writable for uploads is a frequent cause of login refusal. Keep that directory protected and put writable content below it. Check every component of the path, not just the final directory; a group-writable parent can invalidate the jail.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Putting the wrong home path in the account record
With ChrootDirectory /srv/sftp/%u, the home field should be a path visible after the root changes, such as /upload. A host-side path will be resolved from inside the jail and normally does not exist there.
Editing the wrong subsystem
If the configuration uses an external sftp-server, check that the binary exists at the path named by Subsystem sftp. If the installation supports internal-sftp, the in-process server avoids a dependency on a binary inside the jail. Either way, validate the final configuration with sshd -t.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Applying a broad rule accidentally
A global ForceCommand or ChrootDirectory can affect administrators and application accounts. Prefer a narrowly scoped Match User or Match Group block and test with an account that is not your only administrative login.
Windows OpenSSH: set the directory and, if needed, a jail
Windows OpenSSH uses the same high-level concepts but enforces them through Windows paths, service configuration, ownership, and NTFS access-control lists (ACLs). Use a local path for a chroot; a network location is not an appropriate chroot root.
Recommended Free Tools
Option A: use the SFTP subsystem’s -d option
Microsoft’s OpenSSH troubleshooting guidance documents the -d start/upload-directory option with a subsystem declaration such as sftp-server.exe. This is suitable when you need to select the directory used by the SFTP subsystem but do not need to hide the rest of the machine. Follow the installed OpenSSH documentation for the exact Windows path syntax and place the option on the Subsystem sftp line rather than in a client command.
A subsystem start directory is not equivalent to a chroot. Users may still be able to navigate to other locations if their NTFS permissions allow it, and an interactive SSH session remains possible unless separately restricted.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Option B: isolate a user with Match, ChrootDirectory, and ForceCommand
For an SFTP-only account, add a scoped block in sshd_config using Match User or Match Group together with ChrootDirectory and ForceCommand internal-sftp. The chroot path should be on a local volume. Create a writable child directory inside it, and set the account’s home path to that child as seen from inside the jail.
Windows does not use Linux owner and mode bits. Microsoft’s guidance requires the chroot path to have suitable ownership by SYSTEM or Administrators and appropriate NTFS ACLs. Remove user write access from the chroot root and grant write permission only on the intended child directory. Check inherited permissions on each parent directory; an unexpected inherited allow entry can undermine the isolation you intended.
Validate and restart the Windows service
- Save the edited
sshd_config. - Open an elevated administrator context and run
sshd -t. Microsoft specifically recommends this validation after every OpenSSH Server configuration change. - If the command reports an error, correct the directive, path, or ACL issue before touching the service.
- After validation succeeds, restart the “OpenSSH SSH Server” service from Windows Services or your approved service-management method.
- Open a new SFTP connection and verify the landing directory, file operations, and inability to escape the intended root.
If the service will not start after an edit, return to the last known-good configuration and inspect the OpenSSH event or service logs. A syntax check catches configuration errors, while logs are needed for some path, account, and permission failures.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Home-directory change versus chroot: which should you use?
| Decision factor | Home-directory change | Chroot plus SFTP restriction |
|---|---|---|
| Isolation | Changes the initial location only; normal filesystem visibility remains. | Creates a new visible root when correctly configured. |
| Scope | Usually one account’s home record. | One user or group through a Match block, or broader if deliberately configured globally. |
| Linux requirements | Destination permissions must permit the account’s work. | Every chroot component must be root-owned and not writable by group or other users; writable data belongs in a child directory. |
| Windows requirements | Valid local or approved Windows path and NTFS access. | Local chroot path, correct SYSTEM/Administrators ownership, and carefully reviewed NTFS ACLs. |
| SSH capabilities | Shell, forwarding, and other enabled SSH features remain available. | ForceCommand internal-sftp provides an SFTP-only session; disable forwarding features that are not required. |
| Operational risk | Lower configuration complexity. | More permission and path checks; always validate with sshd -t and test before closing your administrative session. |
Troubleshoot the result systematically
The user lands in the wrong directory
- Confirm the account’s home-directory field.
- If a chroot is active, reinterpret that value inside the jail. The account should normally use a path such as
/upload, not the host’s full path. - On Windows, check whether the
-doption on the SFTP subsystem is selecting a different start directory. - Start a new connection; an existing session does not adopt account changes retroactively.
Login fails with “Bad ownership or modes”
- On Linux, inspect ownership and write bits on every directory from the filesystem root through the chroot. The jail and its parents must be owned by
rootand not writable by group or other users. - On Windows, inspect ownership and NTFS ACLs for the local chroot and its parents. Ensure the required
SYSTEMorAdministratorsownership is present and user write access is limited to the intended child directory.
The user can see more than intended
- Verify that the correct
Match UserorMatch Groupblock is being selected. - Confirm that
ChrootDirectoryis spelled correctly and points to the intended local path. - Ensure the account is actually using the restricted SFTP path and is not connecting through a separate SSH configuration or account.
- Use
ForceCommand internal-sftpand disable forwarding options when the account must not obtain a shell or tunnel.
The edited configuration appears to do nothing
- Run
sshd -tagainst the configuration used by the server. - Check that the user or group condition matches the login account exactly.
- Look for an earlier or later
Matchblock that changes the effective settings. - Restart or reload the correct SSH service only after validation, then test with a fresh connection.
- Inspect OpenSSH logs when the service refuses to start or authentication reaches the server but the session setup fails.
Pre-change and post-change checklist
- Decide whether you need a different starting directory or genuine filesystem isolation.
- Record the current account home path and keep an administrative session open.
- For Linux chroots, make every jail component root-owned and non-writable, then create a writable child directory.
- For Windows chroots, use a local path and review
SYSTEM/Administratorsownership plus NTFS inheritance. - Set the account home to the path visible inside the jail.
- Scope restrictions with
Match UserorMatch Group. - Use
ForceCommand internal-sftpwhen the account is intended to transfer files only. - Check the SFTP subsystem declaration and any Windows
-doption. - Run
sshd -tbefore restarting the service. - Test a new login, initial directory, upload permissions, navigation boundaries, and the absence of unwanted SSH features.
What the OpenSSH and Microsoft documentation establishes
The OpenSSH portable sshd_config(5) documentation states: “After the chroot, sshd changes the working directory to the user’s home directory.” Debian’s sshd_config(5) manpage notes that internal-sftp implements an in-process SFTP server. Microsoft’s OpenSSH troubleshooting guidance states: “Every time that you change the OpenSSH Server configuration, validate the change by running sshd -t.” Together, these points explain why the home path, chroot root, subsystem choice, and validation step must be configured as one chain rather than as unrelated settings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
