Separate an OpenSSH SFTP jail root from its upload directory

Check ownership of the whole chroot path before changing upload permissions for an SFTP account.

Source facts

The OpenSSH manual requires all components of ChrootDirectory to be owned by root and not writable by other users or groups. These checks apply regardless of StrictModes. The in-process internal-sftp server avoids a separate support-file environment for SFTP. ForceCommand internal-sftp alone does not disable forwarding; the manual identifies DisableForwarding or individual forwarding controls as separate settings.

Source: OpenBSD — sshd_config manual.

Applicability

This guide follows the OpenBSD/OpenSSH manual’s Unix permission model. Confirm the installed platform and effective sshd configuration before translating it to a different operating system.

DSE recommendation

DSE recommends keeping the jail root under administrative ownership and providing an explicitly authorized writable child directory for uploads. Review every parent component rather than checking only the final folder. Match the account to its intended SFTP-only policy and review forwarding independently. Keep an administrative recovery session available during an approved configuration change. Record the expected landing path and permitted file operations so a working login does not conceal excessive write access.

Verification

Validate the effective account-specific configuration, then test login, upload, rename, and download as required. Confirm that writing to the jail root and accessing outside the intended area fail. Test the agreed forwarding restrictions in a controlled environment and retain sanitized results without account passwords.

Official reference

OpenBSD — sshd_config manual. Reviewed October 14, 2026.