Restrict SFTP access to only certain folders within an accessible root folder

Question

Within my SFTP server, I intend to have a root folder, with several folders for separate entities. These entity folders have sub-directories of their own, which pertain to specific functions.

E.g. User logs into a SFTP session and can see folders A,B and C. Within each folder, are folders D,E and F.

I'd like the SFTP user to only be allowed to access folder D within A,B and C. Folders E and F across A,B and C are not intended for access by said user. Only one user is expected to be using SFTP.

I've looked at the sshd_config file, but I am not sure how this can be enforced using existing policies. Perhaps I can set a user / group policy to this end in Windows 10, but would it apply to the sshd daemon?

Solution

In most SSH/SFTP servers (including Bitvise and OpenSSH), each SSH account exactly corresponds to a Windows user account. This means you can implement this using standard Windows file permissions (access rights), and there's no point in trying to find a SFTP-specific solution.

1. Remove generic "Users" access from the root folder (will probably need to disable inheritance before doing so);
2. Add non-inheritable "Users: Read" access to the root folder, and to the top-level folders;
3. Add inheritable "TheSftpUser: Read" access to every subfolder D;
4. Add access rights for other users to other folders as necessary.