How can I set up a working sftp server for multiple groups with a chrooted directory?

  • 1
    Please don't post answers in the question body. If you want to post a guide, ask a question and post your guide as an answer.
    – terdon
    Jul 26, 2016 at 7:33

2 Answers 2


Reposted from the OP's original question by:

I decided to share what finally worked for me. I am a novice 2 months into Ubuntu so please don't shot me yet :) This is nothing new but I had a hard time finding a complete article that explains how can a novice like me could achieve it.

Sudo vi /etc/ssh/sshd_config

and add

Subsystem sftp internal-sftp
Match group Group-A
    ChrootDirectory /Group-A
    ForceCommand internal-sftp
    AllowTcpForwarding no

Match group Broup-B
    ChrootDirectory /Group-B
    ForceCommand internal-sftp
    AllowTcpForwarding no

save and exit and start creating the users and group directories:

sudo useradd Group-A-Users
sudo useradd Group-B-Users
sudo passwd Username
sudo usermod -G Group-A Group-A-Users= All users that belong to this group
sudo usermod -G Group-B Group-B-Users= All users that belong to this group
sudo mkdir /Group-A
sudo mkdir /Group-B
sudo mkdir /Group-A/Upload
sudo mkdir /Group-B/Upload

Now lets set permission to the directories. The main folder must be own by root and no one should have write access to it by any other user or group or it will result in ssh crashing after restart.

sudo chown root /Group-A
sudo chown root /Group-B
sudo chmod go-w /Group-A
sudo chmod go-w /Group-B
sudo chgrp GroupName /Group-A/Upload
sudo chgrp GroupName /Broup-B/Upload
sudo chmod ug+rwX /Group-A/Upload
sudo chmod ug+rwX /Group-B/Upload

This is a guide for dummy's users like me who are new to Ubuntu and want to setup a secure sftp server for work or friends.


This one way would work, However simply create only one group and add as many users in the particular group so that when the user logs in to the SFTP server he will be chroot to that particular directory.

Then take the ownership of folder ( eg, Folder name is A, B, C and so on ) folder A from root to user x and restrict the access for others and and folder B take the ownership from root to user y and in that way we do not junk up the config file..

Either way is right and it all how you do based on the environment we work and the requirement.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .