Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up the SFTP with different users. I simply need to strict some users to be given stricted Folder Access.

  • General users to access the whole Main FTP Directory normally: /project/workarea/*
  • User X to be able to access only: /project/workarea/room-x/*
  • So the User X should not be able to access other FTP directories above.

The problem is about X User only. (Folder Restriction Issue)
How to configure it please?

share|improve this question
Should the general users only have access to the Main FTP Directory, or do they have access to other directories as well? Should user X have access to any other directories outside of the /project directory? – Paul Dec 27 '12 at 9:03
Hi Paul, as i stated clearly above, general users will access /project/workarea/* and only X user will access only /project/workarea/room-x/* (only room-x folder and below. Not above). (Please mind the asterisks * also.) Just only to consider the issue with X user. (No need to consider about general users and their permissions, whatever they have. You can ignore.) – 夏期劇場 Dec 28 '12 at 5:16

This is the process for constraining users to specific folders over sftp.

The first step is to use the internal sftp service within sshd, by editing /etc/ssh/sshd_config. Change it so it looks like this:

# Subsystem       sftp    /usr/lib/misc/sftp-server
Subsystem       sftp    internal-sftp

At the end, add the following, which will constrain users of the 'sftpusers' group to their home folder only:

 Match Group sftpusers
   ChrootDirectory %h
   ForceCommand internal-sftp
   AllowTcpForwarding no

%h represents their home directory.

Add user x to the sftpusers group:

 useradd -G sftpusers x

Now edit /etc/passwd for user x so that their home directory is the folder they are allowed to access and also change their shell to nologin to prevent shell access:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.