SFTP Only Access on Laravel Forge Server

Requirements

Let's say you want to create 3 SFTP only users

1. mainuser : manage other users' folders and files

2. user01 : can only view/edit own folder and files

3. user02 : can only view/edit own folder and files

Creating Users and Directories

1. Create the 3 users

   sudo adduser mainuser
   sudo adduser user01
   sudo adduser user02
   

2. Create folders for user01 and user02

   sudo mkdir -p /var/sftp/user01/uploads
   sudo mkdir -p /var/sftp/user02/uploads
   

3. Give root write permissions to the same directory, and give other users only read and execute rights

   sudo chmod 755 /var/sftp/user01
   sudo chmod 755 /var/sftp/user02
   

4. Change the ownership for the uploads directory to the user you just created

   sudo chown user01:user01 /var/sftp/user01/uploads
   sudo chown user02:user02 /var/sftp/user02/uploads
   

5. Change ownership to mainuser to view all user folders

   sudo chown root:mainuser /var/sftp
   

Restricting Access to Directory

Note 1: We are creating a new sshd file because it would be cleaner and /etc/ssh/sshd_config automatically includes .conf files in /etc/ssh/sshd_config.d/

Note 2: user01/user02 will default to its own folder, but cannot create folders or files outside the uploads folder

1. Create mainuser sshd config file

   sudo nano /etc/ssh/sshd_config.d/mainuser.conf
   

2. Add to the newly created mainuser conf file

   Match User mainuser
   ForceCommand internal-sftp
   PasswordAuthentication yes
   ChrootDirectory /var/sftp/
   PermitTunnel no
   AllowAgentForwarding no
   AllowTcpForwarding no
   X11Forwarding no
   

3. Create user01 sshd config file

   sudo nano /etc/ssh/sshd_config.d/user01.conf
   

4. Add to the newly created user01 conf file

   Match User user01
   ForceCommand internal-sftp
   PasswordAuthentication yes
   ChrootDirectory /var/sftp/user01
   PermitTunnel no
   AllowAgentForwarding no
   AllowTcpForwarding no
   X11Forwarding no
   

5. Create user02 sshd config file

   sudo nano /etc/ssh/sshd_config.d/user02.conf
   

6. Add to the newly created user02 conf file

   Match User user02
   ForceCommand internal-sftp
   PasswordAuthentication yes
   ChrootDirectory /var/sftp/user02
   PermitTunnel no
   AllowAgentForwarding no
   AllowTcpForwarding no
   X11Forwarding no
   

7. Restart sshd service

   sudo systemctl restart sshd
   

Resource

https://www.digitalocean.com/community/tutorials/how-to-enable-sftp-without-shell-access-on-ubuntu-20-04