Methods such as creating the file
/etc/nologin, setting account login shells to
/sbin/nologin effectively disable user accounts from logging into an interactive shell, but do not protect the system.
If you want to specifically restrict a user to using
sftp only, install a restricted shell that is designed to do exactly that. The
rssh package is a restricted shell designed to work with OpenSSH.
: rssh is a restricted shell for use with OpenSSH, allowing only scp
: and/or sftp. For example, if you have a server which you only want
: to allow users to copy files off of via scp, without providing shell
: access, you can use rssh to do that. It is a alternative to scponly.
You should seriously consider setting a
chroot for the users logging in with the restricted
Read and understand the security implications of restricting users in such a way. Start with the
man pages for
rssh.conf. You should also understand what a
chroot is and how it works.