How do I limit an SFTP user to one directory?

Use OpenSSH's ChrootDirectory with its internal SFTP server on a server you administer. The restricted account sees its assigned directory as /, while a separate subdirectory remains writable for uploads. This does not give the account a shell or forwarding access.

The following Linux example assumes an existing, dedicated account named transloadit, a primary group named transloadit, and a home directory of /home/transloadit. First verify that this account can log in with its SSH key under your existing authentication policy. Do not use an administrator's account. Do not change the restricted account's home directory to /.

Keep an administrator session open while changing SSH settings, and ensure you have another way to access the server if the new configuration is rejected.

Prepare the directories

Create the restricted root, an empty copy of the account's home path inside it, and the upload directory. SSH still reads the account's existing authorized keys before entering the restricted filesystem; do not copy private keys into it.

sudo install -d -o root -g root -m 755 /srv/sftp/transloadit
sudo install -d -o root -g root -m 755 /srv/sftp/transloadit/home/transloadit
sudo install -d -o transloadit -g transloadit -m 750 /srv/sftp/transloadit/uploads

Every component of /srv/sftp/transloadit, including /srv and /srv/sftp, must be owned by root and must not be writable by other users or groups. Only the uploads subdirectory belongs to the restricted account. Do not make the restricted root writable to fix an upload error.

Restrict the account

In /etc/ssh/sshd_config, replace the existing Subsystem sftp line with the following line. Keep it in the global section, before any Match blocks; do not add a second SFTP subsystem declaration.

Subsystem sftp internal-sftp

Add this account-specific block at the end of the configuration:

Match User transloadit
    ChrootDirectory /srv/sftp/%u
    ForceCommand internal-sftp -d /uploads
    DisableForwarding yes
    PermitTunnel no
    PermitTTY no

ForceCommand starts SFTP in /uploads instead of accepting shell commands. DisableForwarding also blocks SSH forwarding, which a forced SFTP command alone does not prevent. The account's existing authentication requirements still apply. Adapt the account name and home path if yours are different, and review any earlier matching rules or included configuration files.

Validate before reloading

Check the syntax and effective configuration for the restricted account:

sudo sshd -t
sudo sshd -T -C user=transloadit,host=localhost,addr=127.0.0.1

In the second command, use the actual client address and hostname when your configuration contains address- or host-specific rules. Confirm that the effective settings include the intended chrootdirectory, forcecommand, disableforwarding yes, permittunnel no, and permittty no. DisableForwarding overrides individual forwarding options that may still appear enabled in this output. Do not reload a configuration that fails validation. Use your operating system's documented SSH service reload command, then verify both a new administrator connection and a new SFTP connection before closing the original session.

From your client, connect with sftp transloadit@your-server.example and check the directory:

sftp> pwd
Remote working directory: /uploads
sftp> cd /
sftp> pwd
Remote working directory: /
sftp> cd ..
sftp> pwd
Remote working directory: /

Upload a harmless test file into /uploads and download it again. Creating a file directly in / must fail. Also verify that a shell command and port forwarding are rejected. The SFTP path /uploads refers to /srv/sftp/transloadit/uploads on the server, not the server's own /uploads.

Use the account with /sftp/import or /sftp/store, following the Robot's authentication and path documentation. A chroot restricts filesystem access; it does not replace account authentication, filesystem permissions, or network policy. See the OpenSSH configuration manual⁠ for the full directive semantics and your distribution's documentation for service management.