SFTP vs. Traditional FTP
Traditional File Transfer Protocol (FTP) sends data—including usernames and passwords—in completely plain text over the network. This is a massive security vulnerability. Secure FTP (SFTP) solves this by tunneling the entire file transfer process through an encrypted SSH connection. Because the OpenSSH server is already installed on virtually every Ubuntu server in existence, you do not need to install complex third-party software like vsftpd or ProFTPD to host a highly secure file server.
Step 1: Create a Dedicated SFTP User
It is incredibly dangerous to give an SFTP user full shell access to your server. You should create a dedicated user whose only permission is to transfer files.
Open your terminal and create a new user (e.g., sftp_vendor):
sudo adduser sftp_vendor
Follow the prompts to assign a strong password to this new account.
Step 2: Create a Secure Directory Structure
To restrict (or “chroot”) the user to a specific directory, the root directory of the chroot jail must be owned exactly by the root user, and no one else can have write permissions to it.
Create the top-level jail directory:
sudo mkdir -p /var/sftp/vendor_files
Set the absolute ownership of the /var/sftp directory to root:
sudo chown root:root /var/sftp
sudo chmod 755 /var/sftp
Now, change the ownership of the inner vendor_files directory to your specific SFTP user, so they actually have permission to upload files there:
sudo chown sftp_vendor:sftp_vendor /var/sftp/vendor_files
Step 3: Configure the OpenSSH Daemon
You must instruct the SSH server to lock this specific user into the directory you just created, and explicitly deny them a terminal shell.
Open the main SSH configuration file:
sudo nano /etc/ssh/sshd_config
Scroll to the absolute bottom of the file and append the following configuration block:
Match User sftp_vendor
ForceCommand internal-sftp
PasswordAuthentication yes
ChrootDirectory /var/sftp
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
Save the file and exit the text editor.
Step 4: Restart the SSH Service
To apply your new security restrictions, you must restart the SSH daemon:
sudo systemctl restart sshd
Step 5: Test the SFTP Connection
From a different computer, attempt to connect to the server using an SFTP client like FileZilla or the command line:
sftp [email protected]
You will be prompted for the password. Once authenticated, your root directory (/) will actually be /var/sftp. If you attempt to run an SSH shell command (like ssh [email protected]), the server will instantly terminate the connection with the message: “This service allows sftp connections only.” Your secure file server is now fully operational.