iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A successful SSH login proves that the server accepted your identity; it does not prove that your account can write to the upload destination. Fix a VPS upload error by checking the exact remote user and path, verifying traversal and write permissions on every directory, then applying the narrowest ownership, group, or ACL change that matches your deployment design. Do not make the web root world-writable with chmod -R 777.
First identify which permission check is failing
There are two very different errors that people describe as “permission denied.” If the message is Permission denied (publickey), or it appears before a remote shell starts, the failure is SSH authentication or SSH’s local key-file checks. If you can open a shell but scp, SFTP, or rsync cannot create a file, the failure is normally filesystem authorization on the VPS.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Authentication and filesystem authorization are separate
SSH verifies the account, key, host, and connection policy. After login, the operating system checks whether that account may traverse directories and create, replace, or remove directory entries. A shell prompt only establishes the first fact.
When the error occurs during login, verify the username, host name, port, and identity file. On the client, private keys should normally be readable only by their owner, and the SSH directory should not be accessible to other users:
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chown -R "$USER:$USER" ~/.sshOpenSSH rejects connections when permissions on directories or key files at either end of the connection violate its checks. Correcting those local permissions does not grant write access to a remote web directory; that is a separate repair.
Trace the account and every component of the path
Run this diagnostic with the same account used by your transfer command:
ssh user@host 'id; namei -l /var/www/site/file.txt; ls -ld /var/www /var/www/site'id shows the effective user and groups. namei -l displays ownership and mode bits for each component, including the file if it exists. The final ls -ld output confirms the directory you intend to modify. This avoids a common mistake: inspecting one account or path while the transfer actually uses another.
How Linux decides whether an upload is allowed
Every parent directory needs traversal permission
To reach /var/www/site, the account needs execute (x) permission on /var, /var/www, and /var/www/site, either directly, through an applicable group, or through an ACL. Execute permission on a directory means “may traverse or access known entries”; it is distinct from read permission, which controls listing names.
A file can show a writable mode while an ancestor directory blocks access. Conversely, read access to a directory does not allow creation. Check the complete path rather than only the target file.
Creating, replacing, and deleting are directory operations
Uploading a new file requires write and execute permission on the destination directory. Replacing a file often involves creating a temporary file and renaming it, so the directory must permit creation and rename; a writable target file alone may not be sufficient. Deleting an entry is also controlled primarily by the containing directory. A transfer that works in a home directory can therefore fail in a service directory with different parent permissions.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Ownership, groups, and the effective mode
For each path component, Linux evaluates the owner, then the group class, then “other.” The first matching class is used; permissions are not added together across classes. Supplementary groups shown by id matter, but a group entry is useless until the account has actually joined that group and started a new session.
Do not infer the resulting mode for new files from the directory’s mode alone. The uploader’s umask removes permission bits, while a default ACL can add or constrain them. Rsync’s options and the server’s policy can also change the result.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
Safe ways to repair a VPS upload path
1. Upload to a user-owned staging directory
This is usually the safest design for a single deploy account. Keep the web-serving tree protected, upload releases into a directory owned by the deploy user, and perform a controlled server-side step that installs the release with the service’s intended owner and modes.
sudo install -d -o deploy -g deploy -m 750 /home/deploy/releases
rsync -az --no-perms --no-owner --no-group ./site/ deploy@host:/home/deploy/releases/site/After transfer, a privileged release script can validate the contents, copy or switch a release directory, and set ownership deliberately. A versioned layout such as /home/deploy/releases/2026-10-14-1200 makes rollback possible and avoids exposing a half-uploaded tree to the web server.
Recommended Free Tools
2. Use a shared deployment group
When several administrators or services must write the same site, create a dedicated group, make it the directory’s group, and grant only the group’s required rights:
sudo groupadd deployers
sudo usermod -aG deployers deploy
sudo chown -R webuser:deployers /var/www/site
sudo chmod -R g+rX /var/www/site
sudo chmod g+rwX /var/www/siteLog out and back in, or start a new session, before relying on the new supplementary group. Avoid applying a blanket write bit to every existing file. Static assets may need group read access while only selected directories need group write access.
Keep new files in the deployment group
Set the setgid bit on shared directories so entries inherit the directory’s group:
sudo find /var/www/site -type d -exec chmod g+s {} +Setgid does not itself grant write permission and does not solve an incorrect umask. Confirm the deploy user’s umask and test that newly created files receive the intended group. A default ACL is more explicit when new files and directories require different defaults.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Grant a narrowly scoped ACL
An ACL is useful when adding the account to a broad group would grant too much access. Grant the deploy account traversal on parents and the required rights on the site directory, then inspect the result:
sudo setfacl -m u:deploy:--x /var/www
sudo setfacl -m u:deploy:--x /var/www/site-parent
sudo setfacl -m u:deploy:rwx /var/www/site
getfacl /var/www/siteUse the real parent path in place of /var/www/site-parent; the account must be able to traverse every ancestor. If new content must remain accessible to a service group, add a default ACL deliberately rather than guessing at recursive modes. Remember that an ACL can be masked by its effective permissions; getfacl shows the mask and the resulting access.
Rank #3
- What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
- Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
- Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
- Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
- Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
4. Change ownership only when the service model calls for it
A deploy-owned tree can be appropriate when the web service only needs read and execute access. In that design, a command such as the following may be correct:
sudo chown -R deploy:web /var/www/siteDo not run recursive ownership changes as a generic fix. They can break a web server that expects a different owner, alter package-managed files, remove the assumptions of a container image, or make later maintenance unexpectedly privileged. Decide which account should own application code, runtime-generated data, logs, and secrets separately.
Verify the repair as the transfer account
Test with the exact account and destination used by the failed upload. A write check alone is not enough; create and remove a harmless file to exercise directory creation and deletion:
sudo -u deploy test -w /var/www/site && echo writable
sudo -u deploy touch /var/www/site/.permission-test
sudo -u deploy rm /var/www/site/.permission-testIf the touch command fails, inspect the first path component that lacks traversal permission. If creation succeeds but the real transfer fails, compare the transfer’s requested operation: recursive synchronization, temporary-file rename, preservation of ownership, or mode changes may require rights that a simple create test does not exercise.
Repeat the test through the same protocol where practical. An SFTP account may be chrooted or forced into a restricted subsystem, while an interactive SSH shell is unrestricted. A command run with sudo is not evidence that the unprivileged transfer account is fixed.
Choose the transfer method that fits the deployment
| Method | Best fit | Important behavior | Typical command |
|---|---|---|---|
| scp | One-off file or directory copy | Simple syntax; the OpenSSH client accepts an identity file with -i. It does not provide a deployment workflow or release validation. |
scp -i ~/.ssh/id_ed25519 ./index.html deploy@host:/home/deploy/releases/site/ |
| SFTP | Interactive inspection and transfer | Supports commands such as ls -l, put, put -R, chmod, chown, and df when the server provides the relevant extensions. put -p requests preservation of permissions and access times where supported. |
sftp deploy@host |
| rsync over SSH | Repeatable synchronization of a directory | Transfers differences and can preserve links, devices, owners, groups, and permissions when requested. Rsync must be installed on both source and destination for a remote transfer. | rsync -az --no-perms --no-owner --no-group ./site/ deploy@host:/home/deploy/releases/site/ |
Use scp for a deliberately simple copy
For a single known file, copy directly into a directory the account owns:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsscp -i ~/.ssh/id_ed25519 ./config.example deploy@host:/home/deploy/releases/If the destination is a protected service directory, scp cannot bypass filesystem authorization. Copy to staging and run a controlled server-side installation step instead of trying to add broad privileges to the SSH account.
Use SFTP when you need to inspect the server
An SFTP session lets you confirm the remote working directory and list metadata before uploading:
Rank #4
- GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
- BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
- EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
- TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.
sftp deploy@host
sftp> pwd
sftp> ls -l /home/deploy/releases
sftp> df -h /home/deploy/releases
sftp> put ./site/index.html /home/deploy/releases/site/index.htmlThe df command depends on the server’s statvfs@openssh.com extension, and some operations depend on server extensions or policy. SFTP’s chmod and chown commands still require the corresponding operating-system privileges; the client cannot grant rights the account does not have.
Use rsync with destination policy in mind
For recurring deployments, avoid allowing local metadata to overwrite the server’s policy accidentally. This command transfers content while leaving destination ownership, group, and mode decisions to the server:
rsync -az --no-perms --no-owner --no-group ./site/ deploy@host:/home/deploy/releases/site/If you need controlled modes instead, use rsync’s --chmod option and document the desired result. Destination umask and default ACLs still affect newly created files. Preservation options such as owners, groups, devices, and permissions can fail or produce unexpected results when the remote account lacks the privilege to apply them.
When ordinary permissions look correct
Inspect ACLs
An ACL may deny access despite apparently permissive owner and group bits, or it may grant access that explains an unexpected result. Run:
getfacl /var/www/siteRead the entries for each ancestor as well as the target directory, including the ACL mask. Remove or adjust only entries that conflict with the intended deployment policy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check SELinux or another mandatory access-control system
On systems using SELinux, mode bits can look correct while the security context denies the SSH or web-service process. Inspect the context:
ls -Zd /var/www/siteA context problem is not fixed safely by changing Unix ownership alone. Use the distribution’s documented labeling and policy tools, and verify whether the account or service domain is permitted to write that location.
Look for a read-only mount
A directory on a read-only filesystem cannot accept uploads regardless of its mode:
Best Value
- 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
- 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
- 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
- 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
- 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.
findmnt -no TARGET,OPTIONS /var/wwwIf the options include ro, identify why the filesystem was mounted read-only before changing application permissions. A read-only bind mount inside a container can produce the same symptom.
Check space and inodes
A full filesystem or exhausted inode table can make a create operation fail. Check both resources:
df -h /var/www
df -i /var/wwwFreeing blocks does not help when inodes are exhausted, and deleting files may be inappropriate if logs or application data require retention. Confirm the filesystem and mount involved, not only the root filesystem.
Investigate chroot, forced commands, and SFTP configuration
An SFTP-only account may be confined by ChrootDirectory, a ForceCommand, or a restricted subsystem definition in the SSH server configuration. The path visible to SFTP can differ from the absolute path visible in a shell. A chroot also has ownership requirements on the chroot directory itself; making the chroot writable can violate the server’s security rules.
Check the effective SSH configuration for the account and the server logs if you administer the VPS. A forced deployment command may deliberately reject arbitrary uploads even when filesystem permissions are correct.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Check containers and bind mounts
Inside a container, numeric user and group IDs determine ownership. A directory that appears owned by www-data in the container may map to an unrelated host ID. Bind mounts can also be read-only or owned by a host account that the container process cannot use. Inspect the mount definition and test from the process namespace that actually performs the write.
Look for a service that changes permissions after upload
Deployment hooks, package updates, synchronization jobs, and application startup scripts can reset ownership or modes immediately after a successful transfer. If a file appears briefly and then becomes inaccessible, inspect scheduled jobs, release scripts, container entrypoints, and service logs rather than repeatedly applying chmod.
A deployment layout that avoids recurring permission errors
Separate upload, activation, and runtime-write responsibilities. A practical arrangement is:
- Staging: a deploy-user-owned directory where uploads and validation occur.
- Releases: immutable, versioned directories installed by a controlled command.
- Current pointer: a symlink or equivalent activation mechanism changed only by the release process.
- Runtime data: separate directories writable by the application only where necessary.
- Secrets: files with narrowly restricted ownership and modes, never inherited from a broad web-root rule.
This arrangement lets the web server read the active release without granting it write access to source files, and it lets the deploy account upload without making the entire document root writable by every process.
Recommended Free Tools
Fast troubleshooting checklist
- Confirm the exact username, host, port, key, and remote path in the failing command.
- Run
id,namei -l, andls -ldas that account. - Verify execute permission on every parent and write-plus-execute permission on the destination directory.
- Check whether the operation replaces an existing entry or needs a temporary-file rename.
- Inspect umask, setgid inheritance, and ACLs before changing modes recursively.
- Test create and remove operations with
sudo -uor the real transfer account. - Check SELinux context, read-only mounts, blocks, inodes, chroot or forced-command rules, and container ownership.
- Use staging plus a controlled release step when the service directory should remain protected.
Bottom line
Permission denied during a VPS upload is usually an authorization or path-design problem, not a failure of SSH itself. Trace the effective account and every directory component, then grant the minimum required access through ownership, a deployment group, or an ACL. Use SFTP for interactive diagnosis, scp for a simple one-off copy, and rsync for repeatable synchronization—preferably into a user-owned staging area followed by a controlled release.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
