Explanation of Configuration Options

Oct 13, 2025 by pynkocean.com 111 views

Introduction

Secure File Transfer Protocol (SFTP) is a secure way to transfer files over the internet. It is widely used in various industries, including web development, system administration, and more. However, with the increasing number of users accessing SFTP servers, it becomes essential to limit access and ensure that users can only access specific folders. In this article, we will discuss how to set a default folder for SFTP users and limit their access using the chroot method.

Prerequisites

Before we begin, make sure you have the following:

Ubuntu 18.04 machine
OpenSSH server installed
SFTP users created

Setting Up SFTP Users

To set up SFTP users, you will need to create a new user and add them to the sftpusers group. You can do this by running the following commands:

sudo adduser sftpuser
sudo usermod -aG sftpusers sftpuser

Creating a SFTP Group

Create a new group called sftpusers and add the SFTP user to it:

sudo groupadd sftpusers
sudo usermod -aG sftpusers sftpuser

Configuring SFTP

To configure SFTP, you will need to edit the /etc/ssh/sshd_config file. Add the following lines to the end of the file:

Match Group sftpusers
  ChrootDirectory /home/sftpuser
  ForceCommand internal-sftp
  AllowTcpForwarding no
  X11Forwarding no
  PasswordAuthentication yes

Explanation of Configuration Options

Match Group sftpusers: This line specifies that the following configuration options apply to the sftpusers group.
ChrootDirectory /home/sftpuser: This line specifies the directory that the SFTP user will be chrooted to. In this case, it is set to the user's home directory.
ForceCommand internal-sftp: This line forces the SFTP user to use the internal SFTP server, which is more secure than the external SFTP server.
AllowTcpForwarding no: This line prevents the SFTP user from forwarding TCP connections.
X11Forwarding no: This line prevents the SFTP user from forwarding X11 connections.
PasswordAuthentication yes: This line allows the SFTP user to authenticate using a password.

Restarting the SSH Server

After making changes to the /etc/ssh/sshd_config file, you will need to restart the SSH server to apply the changes:

sudo service ssh restart

Testing SFTP

To test SFTP, you can use the sftp command:

sftp sftpuser@localhost

Default Folder

To set a default folder for SFTP users, you can create a symbolic link in the user's home directory that points to the desired folder. For example:

sudo ln -s /path/to/default/folder /home/sftpuser/default

Limiting Access

To limit access to specific folders, you can create a new group and add the SFTP user to it. Then, you can create a new directory and set the group ownership to the new group. Finally, you can add the new group to the sftpusers group and restart the SSH server.

Conclusion

In this article, we discussed how to set a default folder for SFTP users and limit their access using the chroot method. We also covered the prerequisites, setting up SFTP users, creating a SFTP group, configuring SFTP, restarting the SSH server, testing SFTP, default folder, and limiting access. By following these steps, you can secure your SFTP server and ensure that users can only access specific folders.

Additional Tips and Tricks

To allow SFTP users to upload files to a specific folder, you can create a new directory and set the group ownership to the sftpusers group.
To allow SFTP users to download files from a specific folder, you can create a new directory and set the group ownership to the sftpusers group.
To allow SFTP users to execute specific commands, you can create a new directory and set the group ownership to the sftpusers group.
To allow SFTP users to access specific files, you can create a new directory and set the group ownership to the sftpusers group.

Troubleshooting

If you encounter any issues while setting up SFTP, you can try the following:

Check the /var/log/auth.log file for any error messages.
Check the /var/log/syslog file for any error messages.
Restart the SSH server to apply any changes.
Check the SFTP user's permissions to ensure that they have the necessary permissions to access the desired folder.

References

Digital Ocean: How To Set Up SFTP on Ubuntu 18.04
Ubuntu: SFTP
OpenSSH: ChrootDirectory
SFTP Default Folder & Limiting Access with Chroot: Q&A =====================================================

Q: What is SFTP and why do I need to limit access to it?

A: SFTP stands for Secure File Transfer Protocol, which is a secure way to transfer files over the internet. Limiting access to SFTP is essential to prevent unauthorized users from accessing sensitive data and to ensure that users can only access specific folders.

Q: How do I set up SFTP users on my Ubuntu 18.04 machine?

A: To set up SFTP users, you will need to create a new user and add them to the sftpusers group. You can do this by running the following commands:

sudo adduser sftpuser
sudo usermod -aG sftpusers sftpuser

Q: What is the `ChrootDirectory` option in the `/etc/ssh/sshd_config` file?

A: The ChrootDirectory option specifies the directory that the SFTP user will be chrooted to. In this case, it is set to the user's home directory. This means that the SFTP user will only be able to access files and directories within their home directory.

Q: What is the `ForceCommand internal-sftp` option in the `/etc/ssh/sshd_config` file?

A: The ForceCommand internal-sftp option forces the SFTP user to use the internal SFTP server, which is more secure than the external SFTP server.

Q: How do I restart the SSH server to apply changes to the `/etc/ssh/sshd_config` file?

A: To restart the SSH server, you can run the following command:

sudo service ssh restart

Q: How do I test SFTP to ensure that it is working correctly?

A: To test SFTP, you can use the sftp command:

sftp sftpuser@localhost

Q: How do I set a default folder for SFTP users?

A: To set a default folder for SFTP users, you can create a symbolic link in the user's home directory that points to the desired folder. For example:

sudo ln -s /path/to/default/folder /home/sftpuser/default

Q: How do I limit access to specific folders?

A: To limit access to specific folders, you can create a new group and add the SFTP user to it. Then, you can create a new directory and set the group ownership to the new group. Finally, you can add the new group to the sftpusers group and restart the SSH server.

Q: What are some additional tips and tricks for securing SFTP?

A: Some additional tips and tricks for securing SFTP include:

Allowing SFTP users to upload files to a specific folder
Allowing SFTP users to download files from a specific folder
Allowing SFTP users to execute specific commands
Allowing SFTP users to access specific files

Q: What are some common issues that I may encounter while setting up SFTP?

A: Some common issues that you may encounter while setting up SFTP include:

Error messages in the /var/log/auth.log file
Error messages in the /var/log/syslog file
SFTP users not being able to access the desired folder
SFTP users not being able to upload or download files

Q: Where can I find more information about SFTP and securing it?

A: You can find more information about SFTP and securing it in the following resources: