Create SFTP-Only Backup Users on Ubuntu with chroot and SSH Keys

Clients usually need a safe place to push backups. Giving them a normal SSH login is risky because a shell can reach far more than a backup folder. In this guide, you will learn to build SFTP-only backup users on Ubuntu: no shell, locked into one folder, and logged in with SSH keys only.

The steps below work on Ubuntu 22.04, 24.04, and 26.04 LTS. Run all server commands as a user with sudo.

Each of your SFTP-only backup users gets one account that can only use SFTP. The account is locked inside its own folder (a "chroot jail"), so it cannot see the rest of your server. Keys are stored outside the jail, so the client cannot change them. 

This least-privilege design fits client backups because it gives no shell access at all. The layout looks like this:

The first step is to create a group for all SFTP-only backup users, then add the first account with no shell. To do this, run the commands below:

The -M option stops Ubuntu from creating a home folder, and /usr/sbin/nologin blocks shell logins.

This is the step that most people get wrong with SFTP-only backup users. SSH requires that the chroot folder and every parent folder above it are owned by root and not writable by anyone else. The user can only write in a sub-folder.

Set the ownership rules with the commands below:

You can check the full path with the following command:

Every folder up to client1 must show root root and drwxr-xr-x.

Now use the command below to create the SSH keys. Run this on the client machine, the server that sends the backups, not on the VPS:

Use a passphrase if a person will use the key. For unattended jobs, use a key without one, and lock it down with the IP limit in the next step.

It is recommended to store the public key for your SFTP-only backup users in a root-owned folder, outside the jail. This is safer than a ~/.ssh folder the user could reach.

Paste the key in one line. The restrict option turns off extras like port forwarding. The optional from= part allows only one source IP. Replace 203.0.113.10 with your client's IP:

Set the file permissions with the following commands:

Ubuntu loads extra files from /etc/ssh/sshd_config.d/, so you do not need to edit the main file. You can create a new one with:

• ChrootDirectory locks the user into /srv/sftp/<username>.
• ForceCommand internal-sftp allows only SFTP. -d /backups opens the backups folder first, and -l INFO logs file actions.
• AuthorizedKeysFile reads keys from the root-owned folder.
• AuthenticationMethods publickey and PasswordAuthentication no allow keys only.
• DisableForwarding yes turns off all forwarding, including X11 and agent forwarding.

Then, test the config and reload SSH. Keep your current session open until you confirm you can still log in:

If you use AllowUsers or AllowGroups in your main config, add client1 or the sftp-backup group there too.

At this point, you must check that everything works. From the client machine, connect with the key:

Inside the SFTP prompt, type the commands below:

You should see only the backups folder at /. Now confirm that shell access is blocked:

The server should reply that this service allows SFTP connections only, and then close the connection. This proves your SFTP-only backup users cannot get a shell.

If something fails, the logs usually show why. Check them first, then use the table below to fix the most common permission errors.

If the log has no internal-sftp lines, check /var/log/auth.log as well. Here are the common problems:

Rotate keys for SFTP-only backup users at least once a year, or at once when a person leaves. The safe way is to add the new key, test it, and then remove the old one:

Put the new key line under the old one, test a login with the new key, then delete the old line. No SSH restart is needed, because SSH reads the key file on each login.

Also, check that backups are really arriving and are not damaged. Compare checksums on both sides:

Run these checks on the server. The first one warns you if no new backup came in the last 24 hours. The other two show your disk space:

If your clients send very large backups, a dedicated server with large storage gives you the space and steady performance you need.

Note: SFTP-only accounts cannot run rsync over SSH, because that needs a shell. Use tools that speak SFTP, such as sftp or rclone.

At this point, you have SFTP-only backup users with no shell, a root-owned chroot jail, key-only login, logging, and an optional IP limit. The most important rule is the ownership of the chroot path, which root owns, and the user writes only in a sub-folder. Add one account per client, test each one, and rotate keys on a schedule. 

If you still need a server for this setup, a Linux VPS with root access is enough to run it.