{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/openssh-sftp-chroot-upload-ownership/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership/",
        "slug": "openssh-sftp-chroot-upload-ownership",
        "url": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/openssh-sftp-chroot-upload-ownership/"
        },
        "title": "Separate an OpenSSH SFTP jail root from its upload directory",
        "summary": "Check ownership of the whole chroot path before changing upload permissions for an SFTP account.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T00:43:32+00:00",
        "modified_at": "2026-10-15T00:44:33+00:00",
        "reviewed_on": "2026-10-14",
        "reading_minutes": 2,
        "word_count": 233,
        "potentially_affected": "This guide follows the OpenBSD/OpenSSH manual’s Unix permission model. Confirm the installed platform and effective sshd configuration before translating it to a different operating system.",
        "dse_recommendation": "DSE recommends keeping the jail root under administrative ownership and providing an explicitly authorized writable child directory for uploads.",
        "primary_source": {
            "name": "OpenBSD — sshd_config manual",
            "url": "https://man.openbsd.org/sshd_config",
            "published_on": null,
            "authority": "man.openbsd.org"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Check ownership of the whole chroot path before changing upload permissions for an SFTP account.</p>\n<h2>Source facts</h2>\n<p>The OpenSSH manual requires all components of ChrootDirectory to be owned by root and not writable by other users or groups. These checks apply regardless of StrictModes. The in-process internal-sftp server avoids a separate support-file environment for SFTP. ForceCommand internal-sftp alone does not disable forwarding; the manual identifies DisableForwarding or individual forwarding controls as separate settings.</p>\n<p>Source: <a href=\"https://man.openbsd.org/sshd_config\">OpenBSD — sshd_config manual</a>.</p>\n<h2>Applicability</h2>\n<p>This guide follows the OpenBSD/OpenSSH manual’s Unix permission model. Confirm the installed platform and effective sshd configuration before translating it to a different operating system.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends keeping the jail root under administrative ownership and providing an explicitly authorized writable child directory for uploads. Review every parent component rather than checking only the final folder. Match the account to its intended SFTP-only policy and review forwarding independently. Keep an administrative recovery session available during an approved configuration change. Record the expected landing path and permitted file operations so a working login does not conceal excessive write access.</p>\n<h2>Verification</h2>\n<p>Validate the effective account-specific configuration, then test login, upload, rename, and download as required. Confirm that writing to the jail root and accessing outside the intended area fail. Test the agreed forwarding restrictions in a controlled environment and retain sanitized results without account passwords.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://man.openbsd.org/sshd_config\">OpenBSD — sshd_config manual</a>. Reviewed October 14, 2026.</p>",
        "content_text": "Check ownership of the whole chroot path before changing upload permissions for an SFTP account.\nSource facts\nThe OpenSSH manual requires all components of ChrootDirectory to be owned by root and not writable by other users or groups. These checks apply regardless of StrictModes. The in-process internal-sftp server avoids a separate support-file environment for SFTP. ForceCommand internal-sftp alone does not disable forwarding; the manual identifies DisableForwarding or individual forwarding controls as separate settings.\nSource: OpenBSD — sshd_config manual.\nApplicability\nThis guide follows the OpenBSD/OpenSSH manual’s Unix permission model. Confirm the installed platform and effective sshd configuration before translating it to a different operating system.\nDSE recommendation\nDSE recommends keeping the jail root under administrative ownership and providing an explicitly authorized writable child directory for uploads. Review every parent component rather than checking only the final folder. Match the account to its intended SFTP-only policy and review forwarding independently. Keep an administrative recovery session available during an approved configuration change. Record the expected landing path and permitted file operations so a working login does not conceal excessive write access.\nVerification\nValidate the effective account-specific configuration, then test login, upload, rename, and download as required. Confirm that writing to the jail root and accessing outside the intended area fail. Test the agreed forwarding restrictions in a controlled environment and retain sanitized results without account passwords.\nOfficial reference\nOpenBSD — sshd_config manual. Reviewed October 14, 2026.",
        "content_markdown": "Check ownership of the whole chroot path before changing upload permissions for an SFTP account.\n\n## Source facts\n\nThe OpenSSH manual requires all components of ChrootDirectory to be owned by root and not writable by other users or groups. These checks apply regardless of StrictModes. The in-process internal-sftp server avoids a separate support-file environment for SFTP. ForceCommand internal-sftp alone does not disable forwarding; the manual identifies DisableForwarding or individual forwarding controls as separate settings.\n\nSource: [OpenBSD — sshd_config manual](https://man.openbsd.org/sshd_config).\n\n## Applicability\n\nThis guide follows the OpenBSD/OpenSSH manual’s Unix permission model. Confirm the installed platform and effective sshd configuration before translating it to a different operating system.\n\n## DSE recommendation\n\nDSE recommends keeping the jail root under administrative ownership and providing an explicitly authorized writable child directory for uploads. Review every parent component rather than checking only the final folder. Match the account to its intended SFTP-only policy and review forwarding independently. Keep an administrative recovery session available during an approved configuration change. Record the expected landing path and permitted file operations so a working login does not conceal excessive write access.\n\n## Verification\n\nValidate the effective account-specific configuration, then test login, upload, rename, and download as required. Confirm that writing to the jail root and accessing outside the intended area fail. Test the agreed forwarding restrictions in a controlled environment and retain sanitized results without account passwords.\n\n## Official reference\n\n[OpenBSD — sshd_config manual](https://man.openbsd.org/sshd_config). Reviewed October 14, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership/",
                "url": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-14"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Separate an OpenSSH SFTP jail root from its upload directory",
                        "item": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership/#article",
                "identifier": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership/",
                "url": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership/",
                "headline": "Separate an OpenSSH SFTP jail root from its upload directory",
                "description": "Check ownership of the whole chroot path before changing upload permissions for an SFTP account.",
                "abstract": "Check ownership of the whole chroot path before changing upload permissions for an SFTP account.",
                "articleBody": "Check ownership of the whole chroot path before changing upload permissions for an SFTP account.\nSource facts\nThe OpenSSH manual requires all components of ChrootDirectory to be owned by root and not writable by other users or groups. These checks apply regardless of StrictModes. The in-process internal-sftp server avoids a separate support-file environment for SFTP. ForceCommand internal-sftp alone does not disable forwarding; the manual identifies DisableForwarding or individual forwarding controls as separate settings.\nSource: OpenBSD — sshd_config manual.\nApplicability\nThis guide follows the OpenBSD/OpenSSH manual’s Unix permission model. Confirm the installed platform and effective sshd configuration before translating it to a different operating system.\nDSE recommendation\nDSE recommends keeping the jail root under administrative ownership and providing an explicitly authorized writable child directory for uploads. Review every parent component rather than checking only the final folder. Match the account to its intended SFTP-only policy and review forwarding independently. Keep an administrative recovery session available during an approved configuration change. Record the expected landing path and permitted file operations so a working login does not conceal excessive write access.\nVerification\nValidate the effective account-specific configuration, then test login, upload, rename, and download as required. Confirm that writing to the jail root and accessing outside the intended area fail. Test the agreed forwarding restrictions in a controlled environment and retain sanitized results without account passwords.\nOfficial reference\nOpenBSD — sshd_config manual. Reviewed October 14, 2026.",
                "datePublished": "2026-10-15T00:43:32+00:00",
                "dateModified": "2026-10-15T00:44:33+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/openssh-sftp-chroot-upload-ownership/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Separate an OpenSSH SFTP jail root from its upload directory"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 233,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "OpenBSD — sshd_config manual",
                    "url": "https://man.openbsd.org/sshd_config"
                }
            }
        ]
    }
}