Disable direct login for normal users (like oracle) in linux but allow scp and sftp?

Question

Is it possible to disable direct login for normal users (like oracle) in linux but allow scp and sftp for that use?

Answer 1

Methods such as creating the file /etc/nologin, setting account login shells to /bin/false or /sbin/nologin effectively disable user accounts from logging into an interactive shell, but do not protect the system.

If you want to specifically restrict a user to using scp or sftp only, install a restricted shell that is designed to do exactly that. The rssh package is a restricted shell designed to work with OpenSSH.

: rssh is a restricted shell for use with OpenSSH, allowing only scp
: and/or sftp. For example, if you have a server which you only want
: to allow users to copy files off of via scp, without providing shell
: access, you can use rssh to do that. It is a alternative to scponly.

You should seriously consider setting a chroot for the users logging in with the restricted rssh shell.

Read and understand the security implications of restricting users in such a way. Start with the man pages for rssh and rssh.conf. You should also understand what a chroot is and how it works.

Answer 2

The login shell can be changed from bash to /usr/sbin/nologin or /bin/false do prevent a normal login. The login shell can be changed with usermod:

usermod user_name -s /usr/sbin/nologin