Sooner or later you need to upload website files to a server, grab a backup, or edit a config in a convenient editor on your own computer. This is what SFTP is for, a file transfer protocol that runs over SSH. If you already connect to your server over SSH, you already have SFTP, and there is nothing extra to install. In this article we will look at how SFTP works, learn to transfer files from the terminal and through FileZilla, and then create a separate user who can work only with files in one folder and cannot log in to the server over SSH. We tested all the examples on a test server with Debian 12.

---

How SFTP works

Despite the similar name, SFTP has nothing to do with the old FTP protocol. It is part of SSH. When you connect over SFTP, the client opens a regular SSH connection to port 22, goes through the same password or key check, and then, instead of a command line, starts a special file-handling program on the server. In the SSH configuration on our Debian 12 server it is enabled by default with the line Subsystem sftp /usr/lib/openssh/sftp-server.

This gives you three handy properties. First, everything you transfer is encrypted just like an SSH session, so your password and files never travel over the network in plain text. Second, you do not need to open new ports in the firewall or install a separate FTP server. Third, the same users and keys that work for SSH also work for logging in.

There is a downside too. A regular user who can connect over SFTP can also log in over SSH and see all the files they are allowed to read. If someone only needs access to upload files, for example a website developer, it is better to create a user who has only SFTP and only one folder. This is done with built-in SSH tools, and we will cover it in step 3.

---

What you will need

• A server with Debian 12 or Ubuntu 24.04 and SSH access to it. How to connect is covered in the article about Termius.
• The sftp program on your computer. It is already there on macOS and Linux. On Windows 10 and 11 it is part of the OpenSSH Client component. If the command is not found, add this component in the Windows additional components section, Optional Features.

---

Step 1. Connect over SFTP from the terminal

Open a terminal on your computer and connect to the server. Instead of server-IP, enter the address of your VPS.

sftp root@server-IP

The program will ask for a password, as with a regular SSH connection, and on the first connection it will ask you to confirm the server key. If you reinstalled the server and got a warning about a changed key, the article about REMOTE HOST IDENTIFICATION HAS CHANGED will help. After you log in, the sftp> prompt appears.

---

Step 2. Transfer files

In an SFTP session you have two current directories, one on the server and one on your computer. Commands for the server are written as usual, and commands for your own computer start with the letter l, short for local.

Command	What it does
pwd and lpwd	Show the current folder on the server and on the computer
ls and lls	List files on the server and on the computer
cd and lcd	Go to a folder on the server and on the computer
put file	Upload a file from the computer to the server
get file	Download a file from the server to the computer
put -R folder and get -R folder	Upload or download a whole folder
reput file and reget file	Resume an interrupted upload or download
mkdir, rm, rename	Create a folder, delete a file, rename
bye	End the session

Below is a real session from our computer. We created a folder on the server, uploaded a file into it, checked that it was in place, and downloaded it back under a different name.

mkdir site-backup
cd site-backup
put report.txt
ls -l
get report.txt report-copy.txt
bye

The file is uploaded to the server and downloaded back

The put command takes a file from the current folder on your computer, and get saves the file into that same folder. So before you start, it is handy to use the lcd command to go to the right folder on your computer.

---

How to connect through FileZilla

If you prefer to drag files with the mouse, use FileZilla, a free program for Windows, macOS and Linux. According to the official FileZilla instructions, connecting over SFTP looks like this.

1. In the quick connect bar at the top of the window, enter the server address in the address field with the sftp:// prefix, for example sftp://203.0.113.10.
2. Enter your username and password.
3. You can leave the port empty, since SFTP uses 22 by default.
4. Click the Quickconnect button or press Enter.

After connecting, you will see the files on your computer on the left and the files on the server on the right. You move files between them by dragging.

Don't forget the sftp:// prefix

Without it, FileZilla will connect over plain FTP to port 21. On a VPS with no FTP server, this connection will not work.

---

Step 3. Create an SFTP-only user

Now we will create the user sftpuser, who can work with files in only one folder and cannot log in over SSH. For this, SSH can lock a user into a directory using chroot. For such a user, the specified folder becomes the root of the file system, and they cannot go above it.

chroot has a strict rule. The folder the user is locked into, and all the folders above it, must be owned by root, and nobody except root may have write permission to them. That is why the user will put files into a nested folder called files, which is already owned by them.

1. Create a group and a user with no access to the command line.

   groupadd sftponly
   useradd -m -d /home/sftpuser -s /usr/sbin/nologin -G sftponly sftpuser
   passwd sftpuser

   The passwd command will ask you to enter a password for the new user twice. The user will connect over SFTP with this password.

2. Create the chroot folder and the folder for files with the right owners.

   mkdir -p /srv/sftp/sftpuser/files
   chown root:root /srv/sftp /srv/sftp/sftpuser
   chmod 755 /srv/sftp /srv/sftp/sftpuser
   chown sftpuser:sftpuser /srv/sftp/sftpuser/files

3. Make a backup copy of the SSH settings and open them.

   cp /etc/ssh/sshd_config /root/sshd_config.bak
   nano /etc/ssh/sshd_config

4. Add the block below at the very end of the file and save it. SSH replaces %u with the username, so one block works for all future users of the sftponly group.

   Match Group sftponly
       ChrootDirectory /srv/sftp/%u
       ForceCommand internal-sftp -d /files
       AllowTcpForwarding no
       X11Forwarding no

5. Check the settings and apply them. If sshd -t prints an error, do not reload SSH, fix the file instead.

   sshd -t && systemctl reload ssh

Don't close your current connection

While you change the SSH settings, keep open the window you are working in. First check in a new window that logging in to the server still works, and only then close the old one. That is what we did, and the root login kept working after the change.

Connect as the new user with the command sftp sftpuser@server-IP. They land in the /files folder right away, can upload files into it, and cannot go any higher. In the root they see only the files folder, and the server's /etc folder simply does not exist for them.

The user is locked into their own folder

If the same user tries to log in over SSH, the server replies This service allows sftp connections only. and closes the connection.

To add another user like this, repeat steps 1 and 2 with their name. You do not need to change the block in sshd_config.

---

Frequently asked questions

fatal: bad ownership or modes for chroot directory

The chroot folder, or one of the folders above it, is not owned by root, or someone else has write access to it. The client only sees Connection closed, and the actual reason can be found in the log with the command journalctl -u ssh -n 20. We got this error when we made the user the owner of /srv/sftp/sftpuser. Restore the owner with the commands chown root:root /srv/sftp/sftpuser and chmod 755 /srv/sftp/sftpuser.

dest open "/report.txt": Permission denied

The user is trying to write a file into the root of their chroot folder, which is owned by root. That is how it should be. Files need to go into the nested files folder, which the user lands in right after logging in.

This service allows sftp connections only.

This is not an error. A user from the sftponly group can work only over SFTP, and logging in to the command line over SSH is not allowed for them.

Permission denied (publickey,password)

The server accepted neither the key nor the password. We got this error when connecting as sftpuser with no key and no password. Check the username and password, and if no password has been set yet, set one with the command passwd sftpuser. If you log in with a key, the public key must be placed in /home/sftpuser/.ssh/authorized_keys, in the home folder and not in the chroot folder. You can read more about keys in the article about SSH keys.

---

Our resources

Telegram channel: https://t.me/f3cloud_news
F3 Cloud: https://f3cloud.com