Isolated Multi-User VPS Architecture for Agencies

Managing multiple clients on a single VPS without proper isolation and structure can quickly become messy. This guide provides complete steps for setting up secure and client-specific environments on Ubuntu VPS, which is ideal for design studios, freelancers, and digital agencies that host multiple projects on one server. You will learn two methods to set up a multi-user VPS setup for agencies, including:

• Method A: Lightweight SFTP-only chroot jails for clients who just need file uploads, which is the safest and simplest option.
• Method B: Full developer workspaces using Docker containers, which offer isolated shells with resource limits while keeping each client’s files cleanly separated.

At PerLod Hosting, we often recommend these methods to our VPS customers who want better security, performance, and manageability across multiple projects on the same server.

To build a secure and scalable foundation for a multi-user VPS setup, you must prepare your server by installing the essential packages, enabling the firewall, and creating the directory structure that will serve as the root for all client data.

You can log in to your server as a root or non-root user with sudo privileges, then run the following commands to prepare your server.

Run the system update and upgrade with the following command:

Install the required packages by using the command below:

We use ACL for user permissions and Nginx to serve each client's website independently.

Allow required ports through the UFW firewall and enable it with the following commands:

To verify your rules, you can check the UFW status:

Create the directory structure that will serve as the root for all client data with the command below:

Once you are done with these requirements, choose one of the following methods to set up a multi-user VPS setup for agencies.

The first method is to implement SFTP-Only Chroot Jails, which is the most secure method for clients who only require file transfer capabilities.

It is best for users who need to upload and download files such as website assets, static site generators, CMS themes, or data exports, but do not need to execute commands on the server. This method is extremely strong because users cannot run shell commands.

Proceed to the following steps to implement the SFTP-Only Chroot Jails method.

First, you must create a system group to which all SFTP-only users will belong. This allows you to apply a single and consistent security policy in the SSH configuration.

To do this, run the command below:

For each client, you must create a strict directory tree within the /srv/tenants root.

Note: An essential security principle here is that the chroot root itself must be owned by root and not writable by the user.

To do this, use the following commands. Remember to replace client code with your own:

At this point, you must create a system user that has no password login and whose shell is set to /usr/sbin/nologin. Also, the user's home directory is set to their chroot jail.

Create the SFTP-only user with the following commands:

Then, make writable folders owned by the client with the commands below:

Important Note: The user can only write to the data/, public/, and upload/ subdirectories, not to the root of their jail.

You must add the client's public key to a root-owned .ssh directory within the jail to prevent them from modifying their own authorized keys.

To do this, you can run the commands below:

In this step, you must add a Match rule in the SSH configuration that applies a strict policy to your sftp-tenants group.

Open the SSH config file with the command below:

In the file, ensure the following settings are applied:

Once you are done, validate the configuration and reload the service with the commands below:

Now you can connect from your local machine to verify the setup. You should be able to transfer files, but not escape the jail or execute shell commands:

You can use the public/ directory to host a static website for the client. Create a simple Nginx virtual host that points directly into their jail with the command below:

Enable the configuration with the command below:

Check for syntax errors and reload Nginx to apply the changes:

Add a quick placeholder page with the commands below:

You can also secure it with Let's Encrypt:

Another method to set up a multi-user VPS setup for agencies is to use Docker containers.

For users who require more than just file access, such as a full development environment with shell access, runtime languages like Node.js, Python, and PHP, and the ability to install packages, Docker containers provide isolated and resource-controlled workspaces for each client.

This method is best for developers or technical clients who need a complete, customizable environment for building and testing applications, but must remain isolated from the host system and other tenants.

Proceed to the next steps to implement the Docker containers.

The first step is to add the official Docker repository and install the Docker Engine, which gives you access to the container runtime, CLI tools, and Compose functionality. To do this, run the commands below:

Each client gets a customized container image for their development needs. You can create a secure Dockerfile with common development tools by using the command below:

Then, build the image with the following command:

Now you can deploy the client's container with strict resource limits to prevent any single tenant from overwhelming the host system.

The following container runs on an isolated network, has its workspace directory bind-mounted for persistent storage, and operates with enforced CPU, memory, and process limits. Also, the sleep infinity command keeps the container running idle until we need to execute commands inside it:

Now that the container is running, you can access the development environment.

For internal team members, direct command-line access via Docker exec provides full control:

You will be user dev inside the container, working in /workspace, which is the client’s data directory.

For client access, a web-based terminal solution can be configured behind secure authentication. You can expose a terminal via code-server or ttyd behind Nginx with Basic Auth. Restrict it to localhost, reverse proxy it, and use HTTPS.

While Docker provides process-level isolation, maintaining strict filesystem separation at the host level is essential for true multi-user security.

Even though development occurs inside containers, all client files remain physically separated in their respective /srv/tenants/client directories. No container can access another client's data path, ensuring that even if a container is compromised, filesystem boundaries remain intact.

In a multi-user VPS environment, your internal team members often need controlled access to client directories. While containers and SFTP jails handle client isolation, Access Control Lists (ACLs) provide the fine-grained permission management required for internal staff.

This allows you to grant specific read, write, or execute permissions to individual team members without compromising the core security separation between clients.

Grant user-specific directory access with the commands below:

Then, configure inheritance with default ACLs:

Check that the ACLs have been applied correctly and review the current permission structure:

A multi-user system requires powerful controls to prevent resource abuse, protect against brute-force attacks, and ensure data recoverability.

You can implement three essential layers of protection, including process limits to contain resource consumption, intrusion prevention to block malicious access attempts, and automated backups to guarantee data persistence.

Even though SFTP-only users do not have shell access, you can implement hard limits on processes and open files as a safety measure. This prevents file descriptor exhaustion that could occur through misconfigured applications.

The limits apply at the PAM level and are enforced system-wide for users in the sftp-tenants group.

Create an SFTP-tenants limits configuration with the command below:

Explanations:

• nproc 50: Limits each user to 50 total processes.
• nofile 1024: Restricts each user to 1024 open file descriptors.
• Hard limits: Cannot be exceeded, even if the user attempts to do so.

Fail2ban provides essential protection against brute-force attacks by automatically banning IP addresses that show malicious behavior. It monitors authentication logs and dynamically updates firewall rules to block repeated failed login attempts.

While SSH protection is enabled by default, Fail2ban can be extended to protect other services like web applications and FTP servers.

You can customize protection settings in /etc/fail2ban/jail.local to adjust bantime, findtime, and maxretry.

You can implement a modern and efficient backup tool that supports encrypted and deduplicated backups to cloud storage.

Install and initialize Restic with the commands below:

Create an automated backup script with the command below:

Make executable and schedule daily backups with:

Regular monitoring and auditing are essential for maintaining security, troubleshooting issues, and understanding usage patterns in a multi-tenant environment.

To track user access and authentication activity, you can use the commands below:

To monitor recent file changes for a specific client, you can run the command below:

Monitor web traffic and errors in real time with the command below:

When you need to temporarily disable a tenant's access without deleting their data, account suspension provides an immediate solution. This method preserves all files and configuration while preventing any new connections or activity.

Immediately lock the user account with the command below:

For a comprehensive lock, you can comment out the SSH match lock in the /etc/ssh/sshd_config file.

Permanently removing a tenant requires careful execution to ensure all system traces are eliminated while maintaining compliance through final backups.

Create the final backup before deletion with the command below:

Delete the user account with the following command:

User deletion may fail due to root-owned directories, so remove it manually with:

Then, remove all tenant directories, data, and configurations:

Reload the web server to apply changes:

Creating isolated user environments on a single VPS gives your digital agency a professional-grade foundation for secure, multi-client hosting and development. By combining SFTP jails for strict file isolation with Docker containers for full-stack workspaces, you can balance performance, control, and safety, all without the complexity of managing multiple servers.

If you’re planning to use a reliable hosting provider, our Flexible VPS hosting solutions are optimized for agencies and developers who need secure and isolated environments for multiple clients.

We hope you enjoy this Multi-user VPS Setup for Agencies. Subscribe to our X and Facebook channels to get the latest articles on VPS hosting.

For further reading:

Enable GPU Passthrough on KVM VPS

Managing and Securing VPS API Gateways

Set up Blockchain Node Hosting on VPS