Do you need a shell for SCP?

Question

I'm allowing a friend a local account on my machine, exclusively for SCP. Can I specify his account's shell as /bin/true, or in any other way limit the account, while still allowing SCP?

Answer 1

You can set that user's shell to rssh or scponly, which are designed precisely for that purpose:

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs.

scponly is an alternative 'shell' (of sorts) for system administrators who would like to provide access to remote users to both read and write local files without providing any remote execution priviledges.

When you run scp, the OpenSSH daemon fires off an scp process with the -f option. When you run sftp, the OpenSSH daemon fires off an sftp-server process. In either case, the subprocess is executed through the user's shell, so that shell must support at least these commands, with a Bourne-like syntax. Any Bourne-style shell will do, as will csh (I think its quoting rules are compatible enough for what sshd uses). Rssh and scponly allow these commands and nothing else. /bin/true would not even run these commands.

Answer 2

No, you don't. As Gilles pointed out, rssh works very nicely to this end, as does scponly. See also the discussion in this related question.