Sometimes the simplest file transfer need doesn’t call for a full Nextcloud instance or a NAS with SMB shares — just a straightforward, secure way to move files to and from a server. Learning to set up an SFTP server on Linux gives you exactly that, using infrastructure you likely already have running through SSH.

What Is SFTP?

SFTP (SSH File Transfer Protocol) is a secure file transfer protocol that runs over an existing SSH connection, encrypting file transfers the same way SSH encrypts terminal sessions. Unlike older FTP, which transmits credentials and data in plaintext, SFTP inherits SSH’s security model entirely, making it a safe default choice for file transfers without any additional protocol-specific hardening required.

Why SFTP Is Often the Right Choice

• No additional service to secure – if you already have SSH properly hardened (), SFTP inherits that same security posture automatically
• Works through existing firewall rules – no additional ports need opening beyond whatever you’ve already configured for SSH
• Built into virtually every Linux distribution – no extra software installation required for basic functionality
• Widely supported clients – FileZilla, WinSCP, and most modern file managers support SFTP natively

Basic SFTP Access (Already Available)

If SSH is already running and a user account exists, SFTP access typically works immediately with no additional configuration:

sftp username@your-server-ip

This gives that user SFTP access to anywhere their account has file permissions, which for most user accounts means broader access than you’d want for a dedicated file transfer purpose.

Restricting Users to SFTP-Only Access

For accounts meant purely for file transfer (not full shell access), configure a chrooted SFTP setup that restricts the user to a specific directory and disables their ability to open an interactive shell session entirely.

Edit /etc/ssh/sshd_config:

Match User sftpuser
    ChrootDirectory /home/sftpuser
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

This configuration ensures the specified user can only perform SFTP file operations within their chrooted directory, with no ability to SSH in for a normal shell session or use SSH for anything beyond file transfer.

Setting Up the Chroot Directory Correctly

SSH requires strict ownership on the chroot directory itself for security reasons — it must be owned by root and not writable by the SFTP user directly:

sudo mkdir -p /home/sftpuser
sudo chown root:root /home/sftpuser
sudo chmod 755 /home/sftpuser

Create a writable subdirectory inside for the user’s actual files:

sudo mkdir /home/sftpuser/files
sudo chown sftpuser:sftpuser /home/sftpuser/files

Restarting SSH to Apply Changes

sudo systemctl restart sshd

Testing SFTP-Only Access

Connect as the restricted user and confirm shell access is denied while file transfer works normally:

ssh sftpuser@your-server-ip

This should be rejected or immediately closed (since ForceCommand internal-sftp prevents shell access), while:

sftp sftpuser@your-server-ip

Connects successfully, restricted to the chrooted directory.

Connecting with a GUI Client

Tools like FileZilla or WinSCP support SFTP natively — simply select SFTP as the protocol, enter your server’s address, port 22 (or whatever custom SSH port you’ve configured, per the earlier hardening guide), and your credentials or SSH key.

Combining with Key-Based Authentication

For SFTP-only accounts specifically intended for automated backups or scripted transfers, combining this setup with key-based authentication (rather than passwords) provides the same security benefits covered in the earlier SSH hardening guide, while still restricting the account to file transfer only.

Final Thoughts

Setting up an SFTP server on Linux provides a genuinely simple, secure file transfer solution that leverages infrastructure most homelab servers already have running. For cases where a full NAS or cloud storage solution feels like overkill, a properly chrooted SFTP-only account offers a lightweight, secure middle ground for straightforward file transfer needs.

Related Posts

• How to Secure a Linux Server with Fail2Ban: A Beginner’s Guide