Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To accept secure file transfers on Ubuntu, install OpenSSH Server, configure its built-in SFTP subsystem, and restart the SSH service after validating the configuration. For users who must have file-transfer access without shell access or visibility beyond a defined directory tree, add a carefully permissioned ChrootDirectory rule. The commands below are Ubuntu-specific; package names, service names, and defaults can vary across Linux distributions.
How do I set up an SFTP server on Linux?
OpenSSH includes an SFTP server subsystem, so on Ubuntu you do not need a separate SFTP-server product. The package to install is openssh-server, which supplies the SSH daemon; openssh-client provides client programs instead. See the Ubuntu OpenSSH server guide.
- Install the server package: run
sudo apt install openssh-serveron Ubuntu. - Choose an account and access scope: use a dedicated account for transfers where practical, and grant it access only to the files and directories its workflow requires. Account and group creation should follow your host’s local policy; there is no single universal command for that step.
- Check the SFTP subsystem configuration: inspect
/etc/ssh/sshd_configand any included configuration snippets under/etc/ssh/sshd_config.d/. Confirm that aSubsystem sftpdirective is present. It may invokesftp-serveror useinternal-sftp. - Validate the configuration: run
sudo sshd -t. No output indicates that the syntax check passed; if it reports an error, correct the configuration before proceeding. - Restart SSH: after a successful check, run
sudo systemctl restart ssh.serviceon Ubuntu. - Test the intended account: connect from an SFTP client to the server address with that account. Confirm that authentication succeeds and that the account can access the intended files. When administering a remote host, test in a separate session and keep the existing working session open until the new connection is confirmed.
Where should OpenSSH settings go?
Ubuntu supports settings in /etc/ssh/sshd_config and in snippets under /etc/ssh/sshd_config.d/. Ubuntu’s main configuration file includes snippets at the beginning, and for most directives OpenSSH uses the first value it finds. A setting added near the end of the main file may therefore fail to override an earlier value from an included snippet. Inspect the effective configuration path and existing settings before editing. Ubuntu notes that snippets keep custom changes separate from system defaults and make updates easier.
For an Ubuntu-specific setup, the SFTP subsystem can be configured with sftp-server or internal-sftp. The latter runs within sshd and can simplify a chrooted configuration. The Ubuntu Noble sshd_config(5) manual documents these options. Do not add a second subsystem directive without checking the existing one.
#1 Best Overall
How do I restrict a user to SFTP only?
Use an SSH Match rule to apply account-specific settings, force the SFTP subsystem, and—if the account must be confined to a filesystem subtree—set a ChrootDirectory. A typical pattern is shown below; replace the example account and directory with values appropriate to your host, and verify the syntax and permissions before restarting:
Match User transferuser
ChrootDirectory /srv/sftp/transferuser
ForceCommand internal-sftpThis is a configuration pattern, not a complete account-creation recipe. Place the rule where it applies to the intended account, taking care that later global directives do not accidentally fall within the match block. Consult the manual for the exact behavior of Match, ChrootDirectory, and ForceCommand on the installed OpenSSH version.
Make the chroot path safe
OpenSSH requires every component of the ChrootDirectory path to be owned by root and not writable by other users or groups. The surrounding directory hierarchy must not be modifiable by processes outside the jail. This is a strict prerequisite, not merely a recommendation: a user-writable chroot root will prevent the intended configuration from working safely.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #2
- 12th Intel Alder Lake N95 Processor – The GMKtec G3 S Mini PC is powered by the 12th Gen Intel N95 processor with 4 cores, 4 threads, 6MB cache and a burst frequency up to 3.4GHz. Compared with N100/N5105/N5100/N5095, the N95 delivers up to 36% overall performance improvement. Perfect for routine tasks, office work, and home entertainment, this compact mini desktop is more convenient than traditional bulky PCs.
- 8GB RAM & 256GB SSD Storage – Pre-installed with 8GB DDR4 memory and a fast 256GB M.2 2242 SSD, the G3 S mini desktop offers quicker startup, smoother multitasking, and faster file transfers. Enjoy seamless performance whether you’re working on multiple applications, browsing, or streaming content.
- Rich Interfaces & Connectivity – The G3 S mini computer comes equipped with USB 3.2 (up to 10Gbps), dual HDMI 2.0 (4K@60Hz), and a 3.5mm audio jack. With support for WiFi 5, Bluetooth 5.0, and Gigabit Ethernet (RJ45 1000MbE), it connects easily with monitors, projectors, printers, office equipment, and other peripherals, making it versatile for both home and business use.
- Dual 4K Display Support – Featuring upgraded Intel UHD Graphics (up to 1000MHz), the G3 S supports 4K video playback and AV1 decoding for a smooth viewing experience. With dual HDMI outputs, you can connect two 4K@60Hz displays simultaneously, enabling efficient multitasking for work and entertainment.
- GMKTEC WARRANTY - GMKtec offers a 3-year limited warranty (1 year replacement + 2 years parts replacement) for each mini PC, starting from the date of the purchase effective on all sales starting Oct. 2026. All defects due to design and workmanship are covered. With a professional after sales team always ready to attend to your needs, you can simply relax and enjoy your mini PC
Because the chroot root itself must not be writable by the transfer user, create a separate writable subdirectory inside it if the workflow requires uploads. Grant access to that subdirectory according to your account and group policy, while leaving the chroot path and its parent components under root ownership with restrictive write permissions.
Shell access and logging
For a file-transfer-only chroot that uses internal-sftp, the user does not need an interactive shell or shell support files inside the jail. Some operating systems may still require /dev/log inside the chroot if SFTP logging is enabled; requirements depend on the system’s logging arrangement.
Basic SFTP account or restricted transfer account?
| Question | Basic SFTP access | Restricted transfer account |
|---|---|---|
| Does the user need shell access? | Possible if permitted by the account’s SSH configuration and policy. | No shell is needed when SFTP is forced with internal-sftp. |
| Must the user be confined to a subtree? | Not necessarily. | Use ChrootDirectory when filesystem confinement is required. |
| Can the host maintain the required directory permissions? | No chroot ownership constraints apply if no chroot is used. | Every chroot path component must be root-owned and not writable by other users or groups. |
| Is logging inside the chroot needed? | Depends on host logging configuration. | Some systems may require /dev/log inside the jail when SFTP logging is used. |
Neither configuration is best for every deployment. Choose according to the account’s required access and whether the chroot permission boundary can be maintained.
Rank #3
Set up SSH key authentication
Ubuntu recommends Ed25519 keys, which have a shorter key size and lower computational requirements than some alternatives. Generate a key pair on the connecting client with:
Recommended Free Tools
ssh-keygen -t ed25519The public key, typically the file ending in .pub, belongs in the target account’s ~/.ssh/authorized_keys. Keep the private key with the client, not on the SFTP server, and consider protecting it with a passphrase. File ownership and permissions matter: Ubuntu’s documented StrictModes yes default checks ownership and modes on user files and home directories. Local configuration and other distributions may differ.
Validate safely before restarting
A malformed SSH configuration can prevent the daemon from starting or lock you out if your only administrative connection is SSH. Before restarting, retain another access path where possible or leave the current working session open. Run sudo sshd -t after each configuration change; only restart with sudo systemctl restart ssh.service once the check succeeds. Then verify a fresh connection and the account’s actual access from a separate session.
Ubuntu defaults are not universal Linux defaults
The Ubuntu Noble sshd_config(5) manual lists Port as 22 and PermitRootLogin as prohibit-password by default, and documents StrictModes yes. These are version-scoped documented defaults, not guarantees for every distribution or a host whose configuration has been changed. Check the installed system’s manual and effective configuration rather than assuming the same settings apply elsewhere.
Changing the SSH port is not a replacement for sound authentication controls, least-privilege accounts, timely updates, or suitable network policy. Port settings are one configuration choice, not a complete access-control strategy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
