Ubuntu SFTP Setup & Secure User Permissions — Remote

Get production-ready SFTP and secure Ubuntu user permissions configured for you—remote worldwide—so partners, clinics, and contractors upload files safely without SSH shell risk. We harden OpenSSH, isolate accounts, and leave you a repeatable permission model instead of a fragile one-off tweak.

What You'll Get

• Hardened OpenSSH SFTP profile - Subsystem, Match blocks, and password/key policy aligned to your risk level
• SFTP-only system users - No interactive shell; dedicated home/chroot layout for each drop account
• Chroot & writable-folder design - Root owned correctly; inbound folders group-writable without breaking jail rules
• Group & ACL permission model - setgid directories, umask guidance, and optional POSIX ACLs for shared ingest paths
• Verification checklist - Login tests, write tests, and negative tests (shell denied, escape blocked)
• Handoff notes - How to add the next user, rotate keys, and reverse changes safely

Serving Remote & surrounds

This page exists for teams that move sensitive files across time zones—telehealth clinics exchanging referral packs, creative agencies receiving client masters, and education providers collecting coursework—without opening full server shells. Work is delivered remotely worldwide; on-site pairing is available where practical for rack-side handoff.

• Regulated or privacy-sensitive offices that need audit-friendly drop folders instead of shared passwords
• Seasonal campaign spikes (enrolment windows, grant submissions, end-of-quarter asset dumps) that overload email attachments
• Multi-site operators who want one Ubuntu host as a controlled ingest point with remote setup and after-hours change windows

How We Work

1. Step 1: Reach Out - Tell us OS version, whether users need key or password auth, which folders must be shared, and any compliance constraints we should respect
2. Step 2: Tailored Plan - Fixed-scope quote for Basic/Standard/Premium: user count, chroot design, ACL depth, and optional fail2ban/logging extras
3. Step 3: We Deliver - Remote session on your Ubuntu host (or jump box): implement Match rules, users, directories, permissions, and live connection tests
4. Step 4: Confirm & Follow-up - Plain-English summary, commands to re-verify, and optional maintenance for adding users or rotating credentials

Common Issues & How to Fix Them

These are patterns we see constantly on Ubuntu SFTP builds—symptoms first, then safe checks you can run before calling us in.

SFTP connects, then immediately drops with "broken pipe" or write failures inside the jail

Usually the chroot root is writable by the user, or a required directory is missing/ownership is inverted—sshd is strict about this and will refuse the session after auth.

1. Step 1: As root, inspect the jail path: confirm the chroot directory is owned by root:root and mode 755 (not group- or world-writable).
2. Step 2: Create a separate inbound folder inside the jail (for example upload/) owned by root:sftpusers with 2775 so the user can write only there, never on the jail root.
3. Step 3: Restart sshd, reconnect with an SFTP client, run pwd/ls, then put a tiny test file only into upload/—success means the jail layout is valid.

User still gets a bash prompt (or scp/rsync shell tricks) when you wanted SFTP-only

Account shells left at /bin/bash, missing ForceCommand internal-sftp, or Match blocks that never matched the user/group mean the restriction never applied.

1. Step 1: Check the account: getent passwd username should show a non-login shell such as /usr/sbin/nologin (or equivalent), not /bin/bash.
2. Step 2: In sshd_config, ensure a Match Group (or User) block sets ForceCommand internal-sftp, ChrootDirectory, and AllowTCPForwarding no—then validate with sshd -t before reload.
3. Step 3: Attempt ssh username@host: it must refuse a shell; sftp username@host must still list the jail. If both fail open, the Match criteria is wrong.

Files land owned by the wrong user/group so staff cannot process the drop folder

Default umask plus missing setgid on the shared directory causes each upload to keep the uploader’s primary group, breaking downstream apps and human review queues.

1. Step 1: On the shared ingest directory, confirm group ownership (e.g. chown root:processors) and mode includes setgid (chmod 2775 path).
2. Step 2: Place SFTP users in the processors group; if mixed service accounts need finer control, add a default POSIX ACL (setfacl -d -m g:processors:rwx) on that folder only.
3. Step 3: Upload a new file and run ls -l: group should be processors and new files should remain group-writable for the processing team.

When DIY is not enough (urgent, unsafe, recurring, or burning time), book Fixwebnode for direct professional support—no freelancers, bidding, or marketplace noise.

Why Choose Fixwebnode

We implement the change ourselves on your Ubuntu systems—enterprise-minded remote IT with human-clear explanations for whoever inherits the box. You get a permission model that survives the next staff onboarding, not a screenshot of someone else’s blog post.

• ✓ Direct provider for Linux/server hardening and patient operator handoff
• ✓ Chroot and ACL patterns proven on multi-tenant ingest hosts
• ✓ Remote worldwide delivery with optional follow-up user adds

Tools & Technologies

Ubuntu LTS (20.04/22.04/24.04), OpenSSH sshd Match blocks, internal-sftp, ChrootDirectory, useradd/usermod, nologin shells, setgid directories, POSIX ACLs (setfacl/getfacl), ssh-keygen authorized_keys, ufw/sshd port policy, optional fail2ban jails, rsyslog/journald auth logging, and FileZilla/WinSCP/lftp client verification.

Perfect For

Operations leads, clinic IT contacts, agency producers, and small SaaS teams who need a controlled Ubuntu dropbox for external parties. Ideal when email attachments are too large or too sensitive, and full SSH accounts are unacceptable. Remote-first delivery keeps change windows short across regions.

Ready to harden file transfer the right way? Chat with us or reach us at fixwebnode.com.au/contact-support and we will map your users and folders before touching production.