Hello everyone!

I have a Debian 12 system which uses SSH. sshd_config has been customized as follows:

Match Group sftpusers
ChrootDirectory /sftp
ForceCommand internal-sftp
AllowTcpForwarding no
X11Forwarding no
PasswordAuthentication yes

This server is to be used as an SFTP server. For this purpose, a script has been written which creates users and places them in the “sftpusers” group. Furthermore, new folders can be created, which are created in /sftp and get the permission root:sftpusers.

The following problem. When I create a session with WinSCP, I can successfully connect to it and see all subfolders of /sftp. But as soon as I want to copy, I have a permission denied.

Then I checked what the permissions look like:
drwxr-xr-x 2 root sftpusers 4096 May 6 10:21 testfolder

So the group has no write permission.

If I give /sftp this permission:
sudo chmod -R g+rw /sftp

I can log in with WinSCP but no longer with the users. I change the setting to :
sudo chmod -R g-w /sftp

I can log in again but can no longer copy.

I'm slowly running out of ideas and would be very happy to receive ideas/help.
Thank you very much!

Update: Could solve the problem in my script changing the number to 775

That's the way it has to be done, because the ChrootDirectory in that case must be owned by root and not writable by any other accounts. Thus, as you've found, you can create subdictories (via root) and give write access for those other accounts to those subdirectories. The same script you have to create the accounts and add them to the group can also create the subdirectories and set their permissions since the whole script is running as root anyway.

That is one approach to setting up chrooted SFTP, and there are at least two more.