How to Set Up a Secure SFTP Server on Ubuntu 26.04

SFTP is the file-transfer subsystem built into OpenSSH. It encrypts authentication, commands and file data over the same SSH transport used for server administration. Unlike FTP, it does not need a separate control connection, passive port range or an additional TLS configuration.

A secure SFTP server is useful for customer uploads, automated exports, off-site backups, team file exchange and software distribution. The important part is not merely installing OpenSSH. You also need to isolate users, prevent shell access where it is not required, protect credentials and make the data recoverable.

Plan the SFTP Server Before Installing It

Decide whether the server is a general SSH host with a few SFTP users or a dedicated transfer endpoint. This guide uses a dedicated group named sftpusers. Members are confined to /srv/sftp/%u, where %u expands to the username.

Keep the operating system and user data separate where possible. HYEHOST Storage VPS plans use a small SSD boot disk and a separate HDD data volume, which makes that boundary obvious.

Install OpenSSH on Ubuntu 26.04

Update the server and install the OpenSSH server package:

sudo apt update
sudo apt full-upgrade -y
sudo apt install openssh-server -y
sudo systemctl enable --now ssh
sudo systemctl status ssh --no-pager

Ubuntu supports modular files in /etc/ssh/sshd_config.d/. A separate snippet keeps the SFTP policy easier to audit and avoids filling the main configuration with local changes.

Before changing SSH remotely, keep the HYEHOST panel console open. Always validate the configuration with sudo sshd -t before restarting the service.

Create the SFTP Group and User

sudo groupadd --force sftpusers
sudo useradd --create-home --shell /usr/sbin/nologin --groups sftpusers filesync
sudo passwd filesync

sudo mkdir -p /srv/sftp/filesync/upload
sudo chown root:root /srv/sftp/filesync
sudo chmod 755 /srv/sftp/filesync
sudo chown filesync:sftpusers /srv/sftp/filesync/upload
sudo chmod 750 /srv/sftp/filesync/upload

The chroot root must be owned by root and must not be writable by the SFTP user. Give the user a writable directory inside it instead. This is the detail most often missed when a new chroot accepts authentication and then immediately closes the session.

Configure a Chrooted SFTP-Only Policy

Create /etc/ssh/sshd_config.d/60-sftp.conf:

Match Group sftpusers
    ChrootDirectory /srv/sftp/%u
    ForceCommand internal-sftp -d /upload
    AllowTcpForwarding no
    X11Forwarding no
    PermitTunnel no
    GatewayPorts no

ForceCommand internal-sftp keeps matched accounts inside the SFTP subsystem instead of giving them an interactive shell. ChrootDirectory changes the filesystem root they can see. OpenSSH's in-process SFTP server is useful here because it does not require a second set of binaries and libraries inside the chroot.

sudo sshd -t
sudo systemctl restart ssh
sudo journalctl -u ssh --since "5 minutes ago" --no-pager

Use SSH Keys for Automated Transfers

Generate an Ed25519 key on the client. Protect interactive keys with a passphrase; automation keys should be narrowly scoped and stored in a secrets manager.

ssh-keygen -t ed25519 -a 64 -f ~/.ssh/hyehost_sftp
ssh-copy-id -i ~/.ssh/hyehost_sftp.pub filesync@sftp.example.com

Because a chrooted account may not use its normal home path as expected, many operators manage keys from a root-owned central directory. Add this global setting before the Match block:

AuthorizedKeysFile /etc/ssh/authorized_keys/%u

sudo install -d -m 755 /etc/ssh/authorized_keys
sudo install -o root -g root -m 600 filesync.pub /etc/ssh/authorized_keys/filesync
sudo sshd -t && sudo systemctl restart ssh

Test the new key in a second terminal before disabling passwords. Once every SFTP user has working key access, add PasswordAuthentication no inside the group Match block.

Open Only the Required Network Access

Ubuntu's default host firewall tool is UFW. If SFTP uses the standard SSH port:

sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

For a private backup endpoint, restrict access to known source addresses instead:

sudo ufw delete allow OpenSSH
sudo ufw allow proto tcp from 203.0.113.10 to any port 22
sudo ufw status numbered

Changing the SSH port reduces log noise but is not a security boundary. Keys, restricted users, current packages, rate limiting and monitored logs matter more.

Test Uploads, Downloads and Isolation

sftp -i ~/.ssh/hyehost_sftp filesync@sftp.example.com
sftp> pwd
sftp> put test-backup.tar.zst
sftp> ls -lah
sftp> get test-backup.tar.zst restored-test.tar.zst

Confirm that the user starts in /upload, cannot browse outside the chroot and cannot open a normal shell. Then compare checksums of the uploaded and downloaded file:

sha256sum test-backup.tar.zst restored-test.tar.zst

SFTP Security Checklist

• Use one account or key per person, service or source system.
• Keep SFTP-only users in a dedicated group with ForceCommand internal-sftp.
• Prefer Ed25519 keys and remove stale keys promptly.
• Restrict source IPs when the transfer endpoints are predictable.
• Disable forwarding and tunnelling for file-only accounts.
• Monitor journalctl -u ssh and authentication failures.
• Apply Ubuntu security updates and restart SSH only after sshd -t passes.
• Set quotas or capacity alerts before one user can fill the filesystem.
• Do not confuse RAID or RAIDZ protection with a backup.

Back Up the SFTP Server

An SFTP server often becomes the place where everyone assumes files are safe. Keep another independent copy. Back up the user data, /etc/ssh/sshd_config.d/, central authorised keys, account metadata and any automation scripts.

Restic, BorgBackup and Kopia can encrypt data before sending it to another host; our open-source backup tools comparison explains the trade-offs. Test a restore into a separate directory and verify checksums rather than relying only on a successful job log.

Ubuntu SFTP Server FAQ

How do I set up an SFTP server on Ubuntu 26.04?

Install openssh-server, create an SFTP-only group and users, configure a Match block with internal-sftp and ChrootDirectory, validate with sshd -t, then restart SSH.

Does SFTP need a separate package?

No. SFTP is part of OpenSSH and normally runs over TCP port 22. It is different from FTP and FTPS.

Can an SFTP user be blocked from shell access?

Yes. ForceCommand internal-sftp prevents normal shell commands for matched users, while the chroot limits the filesystem they can browse.

Should SFTP use passwords or SSH keys?

SSH keys are the better default, especially for automation. Disable passwords for the SFTP group only after every required key has been tested.

Is Storage VPS suitable for SFTP?

Yes. Storage VPS suits archives, backup destinations and capacity-heavy file repositories. Choose SSD Cloud VPS when latency and frequent small random operations matter more than capacity.

Build It for Recovery, Not Just Uploads

A dependable SFTP service is more than an open port. Isolate accounts, use keys, make the chroot ownership correct, restrict network access, monitor failures and keep another copy of the data. Start with one test user, prove upload and download integrity, then add production accounts individually.

Use a HYEHOST Storage VPS for capacity-focused file and backup storage, or a Cloud VPS for faster SSD-backed application transfers.

Official Resources

• Ubuntu OpenSSH server guide
• Ubuntu UFW firewall guide
• OpenSSH sshd_config manual