Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm allowing a friend a local account on my machine, exclusively for SCP. Can I specify his account's shell as /bin/true, or in any other way limit the account, while still allowing SCP?

share|improve this question

2 Answers 2

up vote 25 down vote accepted

You can set that user's shell to rssh or scponly, which are designed precisely for that purpose:

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs.

scponly is an alternative 'shell' (of sorts) for system administrators who would like to provide access to remote users to both read and write local files without providing any remote execution priviledges.

When you run scp, the OpenSSH daemon fires off an scp process with the -f option. When you run sftp, the OpenSSH daemon fires off an sftp-server process. In either case, the subprocess is executed through the user's shell, so that shell must support at least these commands, with a Bourne-like syntax. Any Bourne-style shell will do, as will csh (I think its quoting rules are compatible enough for what sshd uses). Rssh and scponly allow these commands and nothing else. /bin/true would not even run these commands.

share|improve this answer
    
So does this mean /bin/false or /bin/true wouldn't work - or only allow sftp? –  Danny Staple Sep 8 '11 at 15:40
2  
@DannyStaple If a user's shell is set to /bin/false or other program that does nothing, neither scp nor sftp will work. For both commands, the SSH daemon fires off a shell command that runs a dedicated server process (scp -f or sftp-server). It needs a Bourne-style shell, or at least a close enough approximation (such as rssh which allows only these few commands through). –  Gilles Sep 8 '11 at 20:00

No, you don't. As Gilles pointed out, rssh works very nicely to this end, as does scponly. See also the discussion in this related question.

share|improve this answer
    
They're still shells, as pointed out /bin/false will not work, neither will chmod 644 ksh. –  Steve-o Sep 9 '11 at 7:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.