Is it possible to disable direct login for normal users (like oracle) in linux but allow scp and sftp for that use?


Methods such as creating the file /etc/nologin, setting account login shells to /bin/false or /sbin/nologin effectively disable user accounts from logging into an interactive shell, but do not protect the system.

If you want to specifically restrict a user to using scp or sftp only, install a restricted shell that is designed to do exactly that. The rssh package is a restricted shell designed to work with OpenSSH.

: rssh is a restricted shell for use with OpenSSH, allowing only scp
: and/or sftp. For example, if you have a server which you only want
: to allow users to copy files off of via scp, without providing shell
: access, you can use rssh to do that. It is a alternative to scponly.

You should seriously consider setting a chroot for the users logging in with the restricted rssh shell.

Read and understand the security implications of restricting users in such a way. Start with the man pages for rssh and rssh.conf. You should also understand what a chroot is and how it works.


The login shell can be changed from bash to /usr/sbin/nologin or /bin/false do prevent a normal login. The login shell can be changed with usermod:

usermod user_name -s /usr/sbin/nologin
  • Some sftp clients aren't using proper sftp, but rather trying to log on and execute basic commands like cd, ls, ... . In that case use scp or another sftp client program. – jippie May 5 '12 at 6:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.