iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Use OpenSSH’s ForceCommand internal-sftp inside a Match User or Match Group block. It accepts SFTP transfers but replaces shell, command, and subsystem requests with the in-process SFTP server. Add ChrootDirectory when the account must see only a dedicated directory tree. The procedure below creates a restricted account, sets the ownership OpenSSH requires, validates the configuration, and tests both allowed and rejected access without risking your existing administrator session.
What “SFTP without shell access” means
SFTP is a file-transfer protocol carried over an SSH connection. A normal SSH account can request an interactive shell, execute a command, allocate a terminal, open forwarding channels, and transfer files. An SFTP-only account must be limited to the file-transfer service while those other capabilities are refused.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →OpenSSH provides that control with ForceCommand internal-sftp. For a matched account, sshd ignores the command requested by the client and starts its in-process SFTP server instead. The in-process server does not need a shell binary, shared libraries, or ordinary device nodes inside a chroot. This is why it is preferable to trying to block a shell only with a login-shell setting.
A login shell of /usr/sbin/nologin is useful defense in depth, but it is not the mechanism that creates an SFTP-only service. The decisive setting is ForceCommand internal-sftp, placed in a correctly scoped Match block.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Choose whether you need a chroot
There are two common designs. Both prevent an interactive shell when configured with ForceCommand internal-sftp; they differ in what the user can see after authentication.
| Design | Configuration | Filesystem view | Operational trade-off |
|---|---|---|---|
| SFTP-only, no chroot | ForceCommand internal-sftp |
The account remains in the normal filesystem namespace and is limited by ordinary Unix permissions. | Simpler ownership and fewer path-related failures, but more of the system may be visible (usually read-only) to the account. |
| Chrooted SFTP-only | ChrootDirectory ... plus ForceCommand internal-sftp |
The user sees the configured directory as / and cannot traverse outside that tree through the SFTP session. |
Stronger filesystem isolation, but every component of the chroot path must meet sshd’s root-ownership checks and a writable child directory must be provided. |
Use a chroot when an external user, application, or integration should have access to a defined storage area rather than the server’s normal path hierarchy. Omitting the chroot is reasonable for a trusted internal account whose Unix permissions already provide the intended boundary.
Before changing sshd
- Keep an existing administrator SSH session open while editing and reloading the daemon. If the new configuration is rejected, that session is your recovery path.
- Confirm the installed OpenSSH version and read its local
sshd_config(5)manual. Directive defaults, service names, and supported options vary between Linux distribution releases. - Decide whether authentication will use a public key, the distribution’s supported password method, or another centrally managed method. The restriction described here applies after authentication, regardless of which supported method you use.
- Choose a dedicated group if several accounts will share the same policy. A group-based
Matchblock avoids repeating the same restrictions for every user.
Step-by-step: create a chrooted SFTP-only account
1. Create a dedicated group and account
The following example creates an account named alice in sftpusers. The nologin shell prevents normal local logins and is an additional safeguard; the later ForceCommand directive is what enforces the SSH-side restriction.
groupadd sftpusers
useradd -g sftpusers -s /usr/sbin/nologin aliceIf the account already exists, add it to the policy group instead of recreating it:
usermod -a -G sftpusers aliceCheck the resulting identity and group membership before proceeding:
id alice2. Build the root-owned chroot hierarchy
In this example, each user gets a separate tree under /srv/sftp. The chroot directory itself is not the upload directory. OpenSSH requires the chroot and every component of its path to be owned by root and not writable by the group or by others, so the user writes to a child directory.
mkdir -p /srv/sftp/alice/upload
chown root:root /srv/sftp /srv/sftp/alice
chmod 755 /srv/sftp /srv/sftp/alice
chown alice:sftpusers /srv/sftp/alice/upload
chmod 750 /srv/sftp/alice/uploadHere, /srv/sftp/alice becomes the user’s apparent /. The upload directory is visible as /upload and is writable by alice. Adjust the child directory’s group and mode for a deliberate collaboration model, but do not make the chroot root itself user-writable.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Inspect the complete path, including parents that were not created by these commands:
namei -l /srv/sftp/aliceEvery directory leading to the chroot must satisfy sshd’s ownership and mode checks. A permissive parent such as a group-writable /srv can cause the login to fail even when the final directory looks correct.
3. Install the authentication key
For public-key authentication, install Alice’s public key in the normal AuthorizedKeysFile location used by your distribution and ensure the account can be read by sshd. Do not put the key inside the chroot merely because the user will see that directory after login; key lookup normally occurs before the chroot is applied. If your server uses a centrally managed authentication method, complete that method’s normal enrollment instead.
4. Add a narrowly scoped sshd configuration block
Edit /etc/ssh/sshd_config. Keep one global SFTP subsystem definition, then place the policy block at the end of the file so its Match scope does not accidentally alter settings intended for later users.
Subsystem sftp internal-sftp
Match Group sftpusers
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
DisableForwarding yes
PermitTTY no%u expands to the authenticated username, so the same block maps Alice to /srv/sftp/alice and another member to that member’s directory. If your file already contains a Subsystem sftp line, keep a single appropriate definition rather than adding conflicting duplicates.
ForceCommand internal-sftp is the essential restriction. It applies to shell requests, commands supplied with ssh user@host command, and subsystem requests. ChrootDirectory changes the visible filesystem root. DisableForwarding yes disables TCP, agent, X11, and stream-local forwarding for the matched account. PermitTTY no prevents terminal allocation.
5. Validate before reloading
Always parse the complete configuration first:
sshd -tNo output indicates a successful syntax check. If an error is reported, fix it before touching the running daemon. On distributions that use systemd, reload with the service name used by that distribution:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
systemctl reload sshdSome distributions name the unit ssh instead. Use the existing service-management convention on the server. A reload preserves established sessions, while new connections receive the revised policy.
6. Test from a separate client
Use a second terminal or another machine so that a failed test cannot lock you out of your administrative session.
- Start an SFTP session:
sftp alice@server. - Run
pwdandls. In a chroot, the initial directory is inside Alice’s restricted tree; the system’s real/srv/sftp/alicepath is presented as/. - Change to the writable child with
cd /upload, upload a harmless test file, and download it again. - End the session with
bye. - Try
ssh alice@server. The account must not provide an interactive shell. - Try a command request such as
ssh alice@server id. It must not executeid; the forced SFTP service handles the request instead.
A client that reports a subsystem or connection error should be investigated with the troubleshooting steps below before changing permissions broadly.
What the restriction blocks—and what it does not
Interactive shells and arbitrary commands
Because sshd replaces the requested command with internal-sftp, the user cannot select Bash, run a one-off command, or use an SSH session as a general terminal. Setting /usr/sbin/nologin as the account shell reinforces the local-login policy but does not replace the forced command.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsForwarding and terminals
DisableForwarding yes closes the forwarding facilities documented by OpenSSH: TCP forwarding, agent forwarding, X11 forwarding, and stream-local forwarding. PermitTTY no rejects terminal allocation. These settings remove paths that are unrelated to file transfer and should be part of a least-privilege policy for external accounts.
SCP behavior
An SCP client that asks sshd to run a remote scp command cannot do so because arbitrary commands are replaced by internal-sftp. Newer SCP clients can use the SFTP protocol internally; such a client may appear to work because it is effectively making an SFTP request. If your requirement is “SFTP client only,” test the exact client versions used by your partners and document the accepted protocol rather than assuming every program named scp is distinguishable at the server boundary.
Filesystem visibility
ForceCommand alone does not create a filesystem jail. Without ChrootDirectory, the account remains in the normal namespace and sees whatever paths its Unix permissions allow. Add the chroot when path visibility itself is part of the security requirement.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Chroot ownership, writable directories, and logging
The root-owned boundary is an intentional security check. The chroot directory and all path components above it must be owned by root and must not be writable by group or others. Giving the user write permission directly on the chroot root causes the familiar “Bad ownership or modes for chroot directory” failure.
Recommended Free Tools
Provide writable storage one level below the boundary, such as /upload. You can create separate children for incoming files, outgoing files, or shared collaboration, each with its own owner, group, and mode. Keep the boundary itself administrative and immutable to the SFTP account.
With internal-sftp, the chroot does not need a shell, libraries, or ordinary device nodes. If you enable SFTP logging through syslog, the platform may still require a /dev/log socket inside the chroot. Treat that as a distribution-specific logging requirement and verify it with the local OpenSSH and system-logging documentation.
Hardening a multi-user deployment
Use a group policy and per-user paths
A Match Group sftpusers block gives every member the same no-shell, no-forwarding policy. The /srv/sftp/%u pattern keeps each user in a separate tree. If users must exchange files, create an explicitly shared child directory with a dedicated group and carefully chosen set-group-ID and mode settings; do not make the chroot roots mutually writable.
Consider filesystem mount options
For a dedicated partition or filesystem, security guidance from ANSSI notes that nodev, noexec, and nosuid mount options may be appropriate, depending on the storage design. These options are filesystem-level controls, not substitutes for the sshd policy. Test applications that legitimately need executable helpers or special files before applying them.
Keep the policy block’s scope obvious
In sshd_config, a Match block changes how subsequent directives are interpreted. Place the block at the end or deliberately terminate its scope according to your configuration style. A misplaced block can unintentionally apply SFTP restrictions—or other settings—to ordinary administrators.
Review access as an account lifecycle
- Remove a user from
sftpuserswhen the transfer relationship ends, then verify the effective configuration for that account. - Rotate or revoke public keys using your normal key-management process.
- Monitor storage usage inside each writable child so a transfer account cannot fill the filesystem.
- Keep administrative access separate from the SFTP group; do not put a human administrator in the restricted group merely for convenience.
Inspect the effective configuration
When a policy appears not to apply, inspect what sshd calculates for the exact connection context. Substitute the real username, hostname, and client address:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
sshd -T -C user=alice,host=example,addr=192.0.2.10Look for the effective values of forcecommand, chrootdirectory, disableforwarding, and permittty. This catches spelling errors, group-membership mistakes, and Match-scope problems that are not obvious from reading a long configuration file.
Troubleshooting common failures
“Bad ownership or modes for chroot directory”
Inspect every path component:
namei -l /srv/sftp/aliceChange the chroot components to root ownership and remove group/other write permission. Keep user write access on a child such as /upload, not on /srv/sftp/alice itself.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSFTP connects, but the directory is empty or unwritable
An empty root is normal if the chroot contains no children. Create the intended writable child and grant the account access to that child. Verify from the SFTP prompt that the user changes into the child path rather than attempting to write at the chroot root.
SFTP works, but SSH still opens a shell
First confirm that the account is actually in the matched group:
id aliceThen inspect the effective settings:
sshd -T -C user=alice,host=example,addr=192.0.2.10If forcecommand is absent, check that the Match Group sftpusers block is spelled correctly, appears in the active configuration, and is not scoped differently than intended. Confirm that the daemon was reloaded after a successful sshd -t.
Logging fails after chrooting
If internal-SFTP logging is enabled and messages cannot be delivered, check whether your platform expects a /dev/log socket inside the chroot. The exact setup depends on the system logger and distribution; do not copy a device-node layout intended for an external SFTP server when using the in-process implementation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The configuration reload fails
Run sshd -t and correct the first reported error. Keep the existing administrator session open until a new connection has successfully authenticated and the restricted account has passed its SFTP test. A reload failure leaves the previous running configuration in place, but an unvalidated restart can turn a small policy mistake into a wider outage.
Simple SFTP-only account versus chrooted account
The decision is primarily about filesystem isolation, not about shell blocking. Both designs use the same forced in-process server; the chroot adds a second boundary with additional operational requirements.
| Question | Without chroot | With chroot |
|---|---|---|
| Is an interactive shell allowed? | No, when ForceCommand internal-sftp is applied. |
No, with the same forced command. |
| Can the user run arbitrary SSH commands? | No. | No. |
| What filesystem is visible? | The normal namespace, constrained by Unix permissions. | Only the configured chroot tree is visible through the SFTP session. |
| What setup is required? | Account, authentication, and the Match policy. |
All of the previous items plus root-owned path components and writable child directories. |
| What is the main failure mode? | Overly broad Unix read access or an incorrectly scoped policy. | Chroot ownership/mode errors, missing writable children, and distribution-specific logging details. |
| When is it a good fit? | Trusted users whose existing Unix permissions are sufficient. | External users, automation, or any integration that must be confined to a dedicated storage tree. |
Operational checklist
- Create a dedicated group and use a non-login shell as defense in depth.
- Use
ForceCommand internal-sftpin a correctly scopedMatch UserorMatch Groupblock. - Add
ChrootDirectoryonly when filesystem confinement is required. - Make every chroot path component root-owned and not writable by group or others.
- Give the account write permission only on child directories such as
/upload. - Disable forwarding and terminal allocation for a transfer-only account.
- Validate with
sshd -t, reload through the distribution’s service manager, and retain an administrator session. - Test SFTP transfer, shell access, command execution, and the exact SCP-client behavior used by your environment.
- Use
sshd -T -Cwhen the observed behavior does not match the file you edited.
Conclusion
An SFTP-only Linux account is implemented in sshd, not by the account’s login shell alone. Put ForceCommand internal-sftp in a dedicated match block, add DisableForwarding yes and PermitTTY no for a transfer-only policy, and use ChrootDirectory with a root-owned boundary when the user must be confined to a separate tree. Correct ownership, deliberate testing, and effective-configuration inspection are what make the restriction reliable without disrupting administrators.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
