To change the default directory for OpenSSH SFTP on Windows Server 2022, you must modify the SSH server configuration file located at
C:\ProgramData\ssh\sshd_config. By adding a Match block that targets the specific user and setting the
ChrootDirectory directive, you can enforce a strict chroot environment. This ensures that all SFTP sessions for that user are rooted in a designated folder, enhancing security by preventing access to the rest of the file system.
Understanding the Chroot Directory Mechanism
The OpenSSH server on Windows utilizes a feature called "chroot" to restrict a user's file system access. When configured correctly, the user cannot navigate above their assigned root directory using commands like
cd ... This is critical for secure file transfer servers where users should only interact with their own data. The configuration relies on the
sshd_config file, which controls how the SSH daemon behaves. Unlike Linux, where this might be handled by PAM modules or home directory defaults, Windows requires explicit directives in the main configuration file. It is important to note that the path specified in the configuration must be accessible by the system account and properly secured to prevent privilege escalation. For more information on securing your connection, see our guide on
Connect to OpenSSH Server on Windows using PowerShell.
Preparing the Target Directory
Before editing the configuration file, you need to create the directory that will serve as the new default location. This directory must be owned by the SYSTEM account and must not be writable by any other user or group. If the permissions are too open, the SSH server will refuse to start or will fail to chroot the user, logging an error about insecure directories.
Create a new folder, for example,
C:\SFTP\Users\JohnDoe. Then, right-click the folder, select Properties, and go to the Security tab. Remove all users except SYSTEM. Ensure that SYSTEM has Full Control. If you are managing multiple users, you can create a parent directory structure like
C:\SFTP and then subdirectories for each user, ensuring each subdirectory has the correct ownership. This step is crucial because the
ChrootDirectory directive requires that the target directory and all its parent directories up to the root are owned by SYSTEM and not writable by others.
Editing the sshd_config File
The core of the solution lies in modifying the
sshd_config file. On Windows Server 2022, this file is typically located at
C:\ProgramData\ssh\sshd_config. You must use a text editor with administrative privileges, such as Notepad running as Administrator, to make changes. Opening the file without elevation will result in a permission denied error when saving.
Locate the section near the bottom of the file where match blocks are defined. Add a new block specifically for the user whose default directory you wish to change. The syntax is straightforward but case-sensitive. Use the following structure:
Match User JohnDoe
ChrootDirectory C:\SFTP\Users\JohnDoe
ForceCommand internal-sftp
The
Match User directive ensures these settings apply only to the specified user. The
ChrootDirectory sets the root of the file system for that session. The
ForceCommand internal-sftp is essential; it prevents the user from executing shell commands via SSH, restricting them strictly to SFTP operations. Without this, the user might still get a command prompt if they have shell access enabled elsewhere. After adding this block, save the file. Always back up the original
sshd_config before making changes to allow for easy rollback if something goes wrong.
Restarting the SSH Service
Changes to the configuration file do not take effect immediately. You must restart the OpenSSH service for the new settings to load. Open PowerShell as Administrator and run the following command:
Restart-Service sshd
If the service fails to restart, check the event viewer under Applications and Services Logs > OpenSSH > Operational. Common errors include syntax mistakes in the config file or incorrect directory permissions. If the service starts successfully, test the connection from a client machine. Attempt to log in via SFTP and try navigating to the parent directory. The user should be unable to go above their chrooted directory.
For additional context on managing connections, you may find it useful to review
Windows Server 2019: SSH Server Max Number of Connections or Concurrent Users, as limiting concurrent sessions can also impact resource usage in a chrooted environment.
Troubleshooting Common Issues
Even after correct configuration, issues may arise. The most frequent problem is the "Insecure directory" error. This occurs if the chroot directory or any of its ancestors are writable by non-SYSTEM users. Double-check the NTFS permissions. Another issue is the user being locked out entirely. This can happen if the
ForceCommand internal-sftp conflicts with existing public key authentication settings or if the user does not have read/write permissions within the chrooted directory itself. Remember that inside the chroot, the root is the specified directory, so the user needs write access to folders within
C:\SFTP\Users\JohnDoe, not the directory itself relative to the OS root.
Frequently Asked Questions
Can I use the same chroot directory for multiple users?
No, each user should have their own unique chroot directory to ensure isolation. Sharing a directory between users can lead to permission conflicts and security vulnerabilities where one user might access another's files.
What happens if I forget to set ForceCommand internal-sftp?
Without forcing the internal SFTP command, authenticated users may gain access to a standard shell if their account has login rights. This bypasses the chroot restriction and allows them to execute arbitrary commands, defeating the purpose of the secure setup.
How do I verify the current sshd_config syntax?
You can test the configuration by running
sshd -t in an elevated PowerShell window. This command checks for syntax errors and reports any issues before you restart the service, preventing downtime due to misconfigurations.
Does changing the default directory affect FTP clients?
This configuration only applies to SFTP connections managed by the OpenSSH server. Traditional FTP clients using different protocols or services are unaffected unless they also connect through the same OpenSSH instance and adhere to the same match rules.
Is it necessary to disable password authentication for this setup?
While not strictly required for the chroot to work, disabling password authentication and using keys is recommended for enhanced security. This reduces the risk of brute-force attacks against accounts that are already restricted to a specific directory.