iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Set up SFTP by installing the OpenSSH server, creating a dedicated account, and applying a Match rule that runs internal-sftp instead of a shell. Add ChrootDirectory when the account must be confined to one filesystem tree. On Ubuntu, the complete workflow is: install openssh-server, create the user and directory permissions, install an SSH key, validate sshd, reload the service, and test from a second login while your administrative session remains open.
What SFTP is on a VPS
SFTP is the SSH File Transfer Protocol. In this setup it is provided by the OpenSSH server that already handles SSH administration; it is not a second FTP daemon. The same encrypted SSH connection carries directory listings, uploads, downloads, renames and file-permission operations. Most clients connect to TCP port 22 unless you have deliberately changed the SSH listener.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →OpenSSH supplies both secure remote control and secure file-transfer operations. A normal SSH account can usually start a shell, run commands and use forwarding in addition to SFTP. An SFTP-only account changes that default: the server forces the SFTP subsystem and refuses a terminal or arbitrary command. A chrooted account adds a filesystem boundary so the user sees only a selected directory tree.
There are two independent decisions:
- Protocol and session restrictions: use
ForceCommand internal-sftp, and normally disable forwarding and TTY allocation. - Filesystem visibility: use
ChrootDirectoryif the user must not browse paths outside the transfer area.
A non-chrooted SFTP-only user is easier to operate. A chroot plus internal-sftp is a stronger boundary, but every directory component in the jail path must meet strict ownership and mode checks.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Before changing SSH
Keep a recovery session open
Make the changes from an existing root or administrative SSH session and do not close it until a second-session SFTP login succeeds. A syntax error, an incorrect ownership change or a misplaced Match block can prevent new logins. The open session is your recovery path.
Record the image and OpenSSH version
Record the VPS distribution, release and installed OpenSSH version. Directive availability and service names differ among Ubuntu, Fedora, RHEL, Alpine and other images. The commands below use Ubuntu’s package and service names; translate them for the image actually running on your VPS instead of copying them blindly.
Check network policy
Allow the SSH port in the VPS firewall, any host firewall and the provider’s network ACL. If you moved SSH away from port 22, use that port in your SFTP client and tests. SFTP does not require a separate FTP passive-port range.
Install and start OpenSSH on Ubuntu
Update package metadata, install the server package and enable the service:
sudo apt update
sudo apt install openssh-server
sudo systemctl enable --now sshThe package provides sshd, the SSH server configuration and the in-process SFTP implementation used later. Confirm that the service is running before creating users:
sudo systemctl status ssh
sshd -VThe exact version output format varies. On another Linux distribution, use its documented OpenSSH server package and service unit; do not assume that apt or the unit name ssh exists.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesCreate a dedicated SFTP account
Create a group and user
A dedicated group makes the policy easy to apply to several transfer accounts without altering the SSH behavior of administrators. The following creates a system group and an account whose login shell is nologin:
sudo groupadd --system sftpusers
sudo useradd --create-home --home-dir /srv/sftp/alice --shell /usr/sbin/nologin --gid sftpusers aliceFor password authentication, set a password:
sudo passwd aliceOmit the password step when the account must be keys-only. A nologin shell is useful defense in depth, but it is not what enforces SFTP-only behavior; the SSH ForceCommand rule does that even if a client requests a shell or sends another command.
Choose a directory layout
For a non-chrooted account, the user’s home can simply be the transfer directory. For a chrooted account, the path in ChrootDirectory is the jail root and must not be writable by the user. Create a writable child directory for actual transfers:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
sudo mkdir -p /srv/sftp/alice/files
sudo chown root:root /srv /srv/sftp /srv/sftp/alice
sudo chmod 755 /srv /srv/sftp /srv/sftp/alice
sudo chown alice:sftpusers /srv/sftp/alice/files
sudo chmod 700 /srv/sftp/alice/filesAfter chrooting, the user sees / as the jail root. The physical directory /srv/sftp/alice/files appears inside the session as /files, not as the full host path. Tell users to change into /files before uploading.
Recommended Free Tools
Why the ownership split matters
OpenSSH checks every component of the chroot path. The jail root and its parents must be owned by root and must not be group- or world-writable. Making /srv/sftp/alice writable by Alice causes the familiar bad ownership or modes for chroot directory failure. The writable location must be below that root, such as files.
Set up SSH-key authentication
Create an Ed25519 key on the client
On the computer that will connect, create a key pair if one does not already exist:
ssh-keygen -t ed25519Accept the default file or choose a dedicated filename, and protect the private key with a passphrase. Copy the public key while password login is still available:
ssh-copy-id alice@server.exampleReplace the host name with your VPS address and specify -p if SSH listens on a nonstandard port. Test the key explicitly before disabling passwords:
Free tools Windows power users keep installed
One-click scans. No signup required.
ssh -i ~/.ssh/id_ed25519 alice@server.exampleAn SFTP-only rule should start the SFTP client rather than a shell. If the test fails, inspect the server’s authorized-key path, ownership and permissions before changing authentication policy.
Place authorized keys where sshd can read them
A chroot changes the session’s filesystem after authentication. Keep the authorized-key file outside the writable jail, or set an explicit AuthorizedKeysFile path that the server can read before entering the chroot. The exact path must match the distribution’s SSH configuration. Files and parent directories also have to satisfy StrictModes checks: an account’s key file must not be writable by an untrusted user or group.
Do not put authorized_keys inside a directory that the SFTP user can modify. That would let the user replace the key used to authenticate the account.
Configure an SFTP-only Match rule
Ubuntu commonly loads snippets from /etc/ssh/sshd_config.d/. Create a dedicated file such as /etc/ssh/sshd_config.d/sftp.conf, or append the block to the main configuration:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Match Group sftpusers
ChrootDirectory /srv/sftp/%u
ForceCommand internal-sftp
DisableForwarding yes
PermitTTY no
PasswordAuthentication yes%u expands to the authenticated user name, so Alice is chrooted to /srv/sftp/alice. If every account uses the same fixed jail, a literal path is possible, but the per-user form prevents accidental sharing between users.
| Directive | Effect | Operational note |
|---|---|---|
Match Group sftpusers |
Applies following settings only to members of the group. | Add or remove users from the group to change who receives the policy. |
ChrootDirectory /srv/sftp/%u |
Changes the session’s filesystem root to the user’s jail. | Every path component must be root-owned and not writable by group or others. |
ForceCommand internal-sftp |
Runs the in-process SFTP server regardless of a requested shell or command. | internal-sftp is especially suitable for chroots because it needs no binaries or libraries inside the jail. |
DisableForwarding yes |
Disables TCP forwarding, agent forwarding, X11 forwarding and related forwarding features. | Check the installed OpenSSH manual if this directive is unavailable on an older version. |
PermitTTY no |
Refuses allocation of an interactive terminal. | It prevents terminal use but does not replace ForceCommand. |
PasswordAuthentication yes |
Allows passwords for this group. | Remove it when the global policy is keys-only or when you are ready to disable passwords for this group. |
If the global configuration already sets PasswordAuthentication no, the group-specific yes line can allow passwords for this group depending on configuration ordering and version. Decide deliberately whether that exception is wanted; keys-only access is preferable for automated transfers.
Mind Match-block scope
Once Match starts, subsequent lines are interpreted in that conditional context. Do not place unrelated global directives after the block unless you begin a new Match all. A misplaced directive can silently apply only to the SFTP group or produce a syntax error.
Subsystem configuration
Most OpenSSH installations already contain a global Subsystem sftp line. ForceCommand internal-sftp selects the in-process server for matched users. If SFTP reports a subsystem error, look for duplicate or conflicting Subsystem sftp declarations and confirm that the installed version supports the selected command.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteValidate, reload and test safely
Validate before reloading
Always ask sshd to parse the complete configuration:
sudo sshd -tNo output means the syntax check passed. If an error is reported, fix the indicated file or line and run the check again. Do not reload a configuration that has not passed this test.
Reload without dropping existing sessions
sudo systemctl reload sshA reload makes the new policy apply to new connections while preserving the administrative session you are using. Keep that session open until all tests finish.
Test SFTP from a second session
sftp alice@server.exampleAt the sftp> prompt, verify the visible root and the writable directory:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
pwd
ls
cd /files
put test.txt
lsput should complete in /files. The jail root itself should not accept uploads. Test a download as well, and verify that the file appears on the server with the intended owner and mode.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Confirm that shell access is unavailable
Separately run:
ssh alice@server.exampleThe connection should not provide an ordinary shell. Depending on the client and server version, you may see an SFTP protocol error, a forced-command message or an immediate disconnect. The important result is that no shell or arbitrary command is available.
Inspect logs when a test fails
sudo journalctl -u sshSome distributions also write authentication events to a dedicated log file. Read the entries generated at the exact time of the failed login; they usually identify a key rejection, chroot ownership problem or policy mismatch.
Chroot permissions: the rules that prevent most failures
Check every component with namei
When OpenSSH says bad ownership or modes for chroot directory, inspect the entire path rather than only the final directory:
namei -l /srv/sftp/aliceVerify that /srv, /srv/sftp and /srv/sftp/alice are owned by root:root and are not writable by group or others. A writable parent, even several levels above the jail, can invalidate the chroot.
Fix upload permission errors
If login works but put returns Permission denied, check the destination inside the jail. The user should own /files (or receive write permission through its group), while the chroot root remains root-owned:
stat -c '%A %U:%G %n' /srv/sftp/alice /srv/sftp/alice/files
sudo chown alice:sftpusers /srv/sftp/alice/files
sudo chmod 700 /srv/sftp/alice/filesDo not solve the error by making the jail root writable. That trades a local permission problem for a failed or weakened filesystem boundary.
Use group sharing deliberately
If several SFTP accounts must exchange files, create a shared child directory with an appropriate group and setgid policy. Keep the chroot root itself root-owned and non-writable. Test each account’s read and write behavior separately; broad group write access can allow one transfer user to alter another user’s files.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failures and recovery paths
“Permission denied” during authentication
- Confirm that the client is offering the expected private key: use an explicit
-ioption or verbose SSH output. - Check the public key text in the server’s
AuthorizedKeysFile. - Verify ownership and modes on the key file and all parent directories;
StrictModesrejects files that an untrusted account can modify. - Ensure the account is not locked and that the selected authentication method is enabled by the applicable global and
Matchsettings.
“Bad ownership or modes for chroot directory”
Run namei -l on the complete jail path. Restore root ownership and remove group/other write bits from every component. Leave user-write permission only on a child such as /files.
SFTP subsystem errors
Check for a duplicate Subsystem sftp line, a typo in ForceCommand, or a directive unsupported by the installed OpenSSH version. Run sudo sshd -t and read the SSH journal before changing multiple settings at once.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
The account receives a shell
Confirm that the account is actually in sftpusers, that the configuration file is included, and that a later rule is not overriding the intended behavior. Use the server’s effective configuration output where available, then reload and open a new connection. Existing sessions retain their original channel behavior.
Administration is locked out
Use the still-open administrative session to restore the previous snippet or remove the faulty one. Run sudo sshd -t, reload the service, and only then retry a new administrative login. If no session remains, use the VPS provider’s console or recovery mode rather than repeatedly guessing through SSH.
Choose between a normal SFTP account and a chrooted account
| Characteristic | SFTP-only, not chrooted | Chrooted SFTP-only |
|---|---|---|
| Shell access | Blocked with ForceCommand; the user still has the normal host filesystem view permitted by Unix permissions. |
Blocked with ForceCommand and the session is confined to the jail. |
| Path visibility | Other host paths may be visible if Unix permissions allow traversal. | The session’s root is the configured jail; paths outside it are not available through SFTP. |
| Directory setup | Use an ordinary home or transfer directory with normal ownership. | Every jail component must be root-owned and non-writable; a child directory must be writable by the user. |
| Key-file placement | Use the account’s normal home and AuthorizedKeysFile location. |
Keep key material outside writable jail content or configure an explicit readable path. |
| Operational complexity | Lower; fewer permission-specific failure modes. | Higher; path ownership and Match scope must be exact. |
| Recovery | Usually limited to correcting account, key or group settings. | Requires checking the whole path with namei -l and preserving an administrative session during changes. |
Use the simpler non-chrooted policy when the account is trusted to see the host paths that Unix permissions already expose. Use a chroot when an integration partner, upload-only identity or multi-tenant workflow requires a clear filesystem boundary. Chroot is not a substitute for file permissions, backups or application-level validation.
Security and maintenance practices
Prefer keys for automated transfers
Passwords are difficult to rotate safely in scripts and are exposed to guessing attacks. Use Ed25519 keys with passphrases for human operators, restrict private-key file permissions on clients, and remove a public key when its owner or automation job is retired. Keep at least one tested administrative key outside the SFTP policy.
Limit the account’s purpose
- Put transfer identities in the dedicated group instead of applying the rule to all users.
- Keep
PermitTTY noandDisableForwarding yesfor accounts that only exchange files. - Give write permission only to the required child directory and use the narrowest practical Unix mode.
- Do not install shell utilities, device files or unnecessary application data inside the jail.
Monitor and rotate
Review SSH authentication logs, failed-login patterns and successful transfers according to your retention policy. Rotate keys when staff, vendors or automation systems change. Before changing ownership, paths or the SSH configuration, repeat the two-session procedure: retain an administrative connection, validate with sshd -t, reload, and test a fresh SFTP connection.
Recommended Free Tools
Plan for disk and quota problems
SFTP cannot upload when the VPS filesystem is full, an inode limit is exhausted or a filesystem quota denies the operation. Monitor free space and inodes on the host, and make sure the child transfer directory is on the intended volume. A chroot changes path names presented to the client but does not create a separate disk or quota by itself.
Client connection examples
Interactive clients use the same SSH credentials:
sftp -i ~/.ssh/id_ed25519 alice@server.exampleFor a nonstandard port:
sftp -P 2222 -i ~/.ssh/id_ed25519 alice@server.exampleBatch transfers can use SFTP commands supplied on standard input, provided the private key is protected and the job handles host-key verification. Do not disable host-key checking merely to make an automation script connect; install and review the VPS host key through a trusted channel.
Final verification checklist
- Package: OpenSSH server is installed and its service starts at boot.
- Identity: The transfer account belongs to the intended group and has no unnecessary shell access.
- Authentication: The expected SSH key works, and password policy matches your decision.
- Policy: The
Matchblock forcesinternal-sftp, disables forwarding and refuses TTY allocation. - Jail: Every
ChrootDirectorycomponent is root-owned and not group/other-writable. - Data directory: A child such as
/filesis writable by the SFTP account. - Validation:
sudo sshd -tpasses before every reload. - Testing: A fresh SFTP session can list, upload and download, while an SSH attempt cannot obtain a shell or escape the configured root.
- Recovery: An administrative session or provider console remains available until the test is complete.
This arrangement gives a Linux VPS a dedicated, encrypted file-transfer identity without deploying a separate FTP service. Start with a non-chrooted account when simplicity is the priority; add the root-owned chroot and writable child directory when filesystem isolation is a requirement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
