SFTP User Sees Only One Folder With Chroot Directory

A default SFTP login on Windows lands in the user's home folder - and from there, most of the C drive is browsable. ChrootDirectory turns the login into a jail: the user sees one folder and nothing above it.

By Technical AnshuWindows 10 / 118 minute read

Watch the full video above - Create an SFTP Server in 60 Seconds by Technical Anshu

Here is the fact the quick setup leaves out: an SFTP user is a real Windows user, and SSH gives that user a view of the file system that NTFS permissions allow - which is a lot. The fix is one block of configuration in C:\ProgramData\ssh\sshd_config: a Match section with ChrootDirectory. It takes five minutes and it is the single most valuable setting on a shared SFTP server.

C:\ProgramData\ssh\sshd_config - the jail block

Match User reports

ChrootDirectory C:\SFTP\reports

ForceCommand internal-sftp

AllowTcpForwarding no

Four lines in sshd_config. Everything above the folder simply disappears for this user.

Why the Default Login Sees Too Much

Without a jail, a user who connects with FileZilla can click up from their home folder and browse C:\Users, C:\Program Files and any folder whose permissions allow reading - which on a typical Windows PC is most of them. They cannot change protected system files, but reading and downloading is more than enough damage. Folder permissions alone are a weak fence here; the jail removes the rest of the drive from view entirely.

The Rules the Jail Folder Must Follow

OpenSSH is strict about the chroot folder, and the login simply fails if these rules are broken:

The folder in ChrootDirectory - and every folder above it - must be owned by SYSTEM or an administrator
The jailed user must not have write permission on the chroot folder itself
So create a subfolder inside it, for example C:\SFTP\reports\upload, and give the user full control of that subfolder only

This surprises everyone the first time: the user uploads into the subfolder, not the jail root.

Add the Match Block and Restart

Open C:\ProgramData\ssh\sshd_config in Notepad as administrator
Add the Match block shown in the panel above at the end of the file, with your username and folder
To jail every member of a group instead, use Match Group sftpusers and ChrootDirectory C:\SFTP\%u - %u expands to the username
Save, then restart the service with Restart-Service sshd
Connect as that user and confirm: the top of the tree is their folder, and there is no way up

What ForceCommand internal-sftp Adds

The ForceCommand internal-sftp line makes the account file-transfer-only. Even if someone has the password, they cannot open an interactive SSH shell or run commands on the PC - the connection serves files and nothing else. Combined with AllowTcpForwarding no, the account cannot be used as a tunnel into your network either. For pure file-exchange accounts, always add both lines.

Watch the Full Video

See the complete SFTP server setup on screen, step by step, in the Technical Anshu video.

Watch Full Video

Frequently Asked Questions

The jailed user cannot log in at all. What went wrong?

Almost always the ownership rules: the chroot folder or a folder above it is writable by the user, or owned by the user. Make SYSTEM or Administrators the owner of the jail path, remove the user's write access on the jail folder itself, and give write access only to a subfolder inside it.

Can one Match block jail several users into separate folders?

Yes. Use Match Group with ChrootDirectory C:\SFTP\%u - the %u token is replaced by each username, so every member of the group lands in their own folder under C:\SFTP.

Does ChrootDirectory work on the Windows OpenSSH Server?

Yes, the Windows port of OpenSSH supports ChrootDirectory with the same rules as on Linux, including the strict ownership requirements. The config file lives at C:\ProgramData\ssh\sshd_config.

This guide is based on the Technical Anshu SFTP server video - Stuck on a step? Ask in the video comments and you will get a reply.