Is it possible to disable direct login for normal users (like oracle) in linux but allow scp and sftp for that use?
Methods such as creating the file
/etc/nologin, setting account login shells to
/sbin/nologin effectively disable user accounts from logging into an interactive shell, but do not protect the system.
If you want to specifically restrict a user to using
sftp only, install a restricted shell that is designed to do exactly that. The
rssh package is a restricted shell designed to work with OpenSSH.
: rssh is a restricted shell for use with OpenSSH, allowing only scp : and/or sftp. For example, if you have a server which you only want : to allow users to copy files off of via scp, without providing shell : access, you can use rssh to do that. It is a alternative to scponly.
You should seriously consider setting a
chroot for the users logging in with the restricted
Read and understand the security implications of restricting users in such a way. Start with the
man pages for
rssh.conf. You should also understand what a
chroot is and how it works.
The login shell can be changed from
/bin/false do prevent a normal login. The login shell can be changed with
usermod user_name -s /usr/sbin/nologin