Is it possible to disable direct login for normal users (like
oracle) in Linux but allow
sftp for that use?
Methods such as creating the file
/etc/nologin, setting account login shells to
/sbin/nologin effectively disable user accounts from logging into an interactive shell, but do not protect the system.
If you want to specifically restrict a user to using
sftp only, install a restricted shell that is designed to do exactly that. The
rssh package is a restricted shell designed to work with OpenSSH.
: rssh is a restricted shell for use with OpenSSH, allowing only scp : and/or sftp. For example, if you have a server which you only want : to allow users to copy files off of via scp, without providing shell : access, you can use rssh to do that. It is a alternative to scponly.
You should seriously consider setting a
chroot for the users logging in with the restricted
Read and understand the security implications of restricting users in such a way. Start with the
man pages for
rssh.conf. You should also understand what a
chroot is and how it works.
You can Add this to sshd_config:
Match User oracle ForceCommand set - ""$SSH_ORIGINAL_COMMAND; [ "$1" = "scp" ] || exit 1; CMD=`IFS='\`&;<>'; set - ""$SSH_ORIGINAL_COMMAND; echo $1`; [ "$CMD" ] || exit 1; exec $CMD
Here, I'm matching the user 'oracle'. Instead you can use
Match group scponly to match users within the 'scponly' group. If anyone tries to connect in a way that doesn't run scp, then it will silently exit with return code 1.
If the account uses key-based authentication, you can prepend the key in the user's .ssh/authorized_keys file with
While I've added some safety against manipulating the file to cause a rogue command to be executed (by truncating at any
&``;<> characters), I can't be sure that this can't be worked around some way I haven't thought of.
This is all a bit long and messy to stick into an sshd_config file, and a typo could break stuff for other users. It might be better to create a script that does the checking for "scp", and then just call that script from the ForceCommand, thus making the mods in
sshd_config much simpler. Check out https://serverfault.com/questions/749474/ssh-authorized-keys-command-option-multiple-commands for some examples of this.