Upload Only SFTP Drop Folder That Hides Other Peoples Files
One shared upload folder has an obvious flaw: everyone who can upload can also browse and download everyone else's files. The drop folder pattern fixes the privacy problem with nothing but permissions.
By Technical AnshuUbuntu Server7 minute read
Watch the complete Ubuntu SFTP server setup step by step in the video
Accountants, print shops and support desks all hit the same shape of problem: outsiders must deliver files to you, and must never see each other's deliveries. The answer is a folder where users can write but cannot read or list - a digital letterbox. It pairs naturally with the jailed accounts from this series, and it has two behaviours you must warn users about up front, covered at the end.
Terminal - the letterbox permissions
$ sudo mkdir -p /srv/sftp/dropbox
$ sudo chown root:sftpusers /srv/sftp/dropbox
$ sudo chmod 730 /srv/sftp/dropbox
$ ls -ld /srv/sftp/dropbox
drwx-wx--- root sftpusers /srv/sftp/dropbox
Mode 730 - the group can enter the folder and write into it, but cannot list or read what is inside. Read permission is the one deliberately missing.
1
Why Read Permission Is the Whole Trick
On Linux folders, the three permissions do three different jobs: execute lets you pass into the folder, write lets you create files in it, and read lets you list its contents. Ordinary upload folders grant all three. The letterbox grants write and execute but withholds read, so a user can drop a file in - and cannot see names, sizes or contents of anything already there, including files they uploaded a minute ago.
2
Create the Drop Folder
Place it inside your SFTP area, for example /srv/sftp/dropbox
Own it by root and the transfer group: sudo chown root:sftpusers /srv/sftp/dropbox
Set the mode: sudo chmod 730 /srv/sftp/dropbox - owner root keeps full control, the group gets write plus enter, everyone else gets nothing
If your users are jailed per-person, give each jail an uploads folder with the same 730 pattern owned by their group, or point all jails at one shared drop folder your team empties
Files arrive owned by each uploader; your admin account reads and moves them from the server side, where the restriction does not apply to root
3
Tell Users the Two Honest Limitations
This pattern confuses people if you deploy it silently, so say both of these out loud before go-live:
They cannot confirm by looking. After uploading, the folder appears empty to them - the file is there, they simply have no list permission. Agree a ritual instead: the client shows a transfer-complete message, or your team confirms receipt
Same filename means a failed or replaced upload. A user cannot overwrite a file they cannot read in many client setups, and cannot delete their own mistake. Ask for dated or uniquely named files, such as invoice-2026-10-25.pdf, and the collisions mostly vanish
4
Collect and Clear It Like a Mailbox
A drop folder that nobody empties becomes a junk drawer. The working routine is dull on purpose: an admin checks it on a schedule, moves files to their real homes, and leaves it empty. Old unclaimed files get deleted on a stated day of the month, announced in advance. If material must also flow back to clients, give returns their own per-person folder from the jail guide - never loosen the drop folder to do both jobs.
Watch the Full Video
See the whole Ubuntu SFTP setup done live, with the exact clicks and commands, in the Technical Anshu video.
Why can the user not even see their own uploaded file?
Because listing a folder needs read permission on the folder, and the letterbox deliberately withholds it from everyone in the group. The upload itself succeeds; only the view is blocked. That blindness is the privacy feature working as designed.
Can a user overwrite or delete a file they dropped by mistake?
Usually no - replacing or deleting needs more access than the letterbox grants. Collect the corrected file under a new name, and let the admin remove the bad one from the server side.
Is a drop folder enough for sensitive documents?
It solves the other-clients problem, and SFTP encryption solves the network problem. The remaining duty is yours: empty it promptly, store the files somewhere access-controlled, and do not leave deliveries sitting in it for months.
This guide is based on the Technical Anshu Ubuntu SFTP server video - Stuck on a step? Ask in the video comments and you will get a reply.