Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is it possible to disable direct login for normal users (like oracle) in linux but allow scp and sftp for that use?

share|improve this question

2 Answers 2

Methods such as creating the file /etc/nologin, setting account login shells to /bin/false or /sbin/nologin effectively disable user accounts from logging into an interactive shell, but do not protect the system.

If you want to specifically restrict a user to using scp or sftp only, install a restricted shell that is designed to do exactly that. The rssh package is a restricted shell designed to work with OpenSSH.

: rssh is a restricted shell for use with OpenSSH, allowing only scp
: and/or sftp. For example, if you have a server which you only want
: to allow users to copy files off of via scp, without providing shell
: access, you can use rssh to do that. It is a alternative to scponly.

You should seriously consider setting a chroot for the users logging in with the restricted rssh shell.

Read and understand the security implications of restricting users in such a way. Start with the man pages for rssh and rssh.conf. You should also understand what a chroot is and how it works.

share|improve this answer

The login shell can be changed from bash to /usr/sbin/nologin or /bin/false do prevent a normal login. The login shell can be changed with usermod:

usermod user_name -s /usr/sbin/nologin
share|improve this answer
    
Some sftp clients aren't using proper sftp, but rather trying to log on and execute basic commands like cd, ls, ... . In that case use scp or another sftp client program. –  jippie May 5 '12 at 6:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.