I am aware that this is security through obscurity, however this is for training purposes and will not be accessible via the Internet. It will merely be used as an internal tool.

I have looked at the following link: How to disable sftp for some users, but keep ssh enabled?

The problem is that it doesn't answer my question which is described below:

I am attempting to setup a virtual server which allows one user to log in to the server using sftp, and another user to log in to the server using ssh.

The sftp portion works and is done by forcing internal-sftp within the sshd_config file shown further within this question. This part works as it disallows the user from logging into the server using ssh, and only allows them access to the sftp jail which I have created.

For the other user which is only meant to be able to access the Chroot jail via ssh, I am unsure of how to disallow access via sftp. The problem is that I have specifically created a chroot jail for that user to prevent commands such as ls and cat, however if the user accesses the server using sftp, they are able to use those commands.

The section within the /etc/ssh/sshd_config is as follows:

Match User test1
        ChrootDirectory /home/jail
        X11Forwarding no
        AllowTcpForwarding no

# Match Group sftpusers
Match User test2
        ChrootDirectory /sftp/guestuser
        ForceCommand internal-sftp
        AllowUsers test2

I have attempted to add:

ForceCommand Subsystem sftp /bin/false or
ForceCommand sftp /bin/false or
Subsystem sftp /bin/false or
Match User test1

However none of the aformentioned additions work with sshd_config.

So my question is:

Is there a way to prevent user1 from accessing the server via sftp? If not is there a way to remove certain commands from sftp, such as ls or cat?

Any advice would be greatly appreciated.

  • "however if the user accesses the server using sftp, they are able to use those commands" Could you clarify this? Are you saying they can use an sftp client to make a connection and then use the client's "ls" command to list files? More generally, are you trying to prevent these jailed users from using sftp at all, or just trying to limit what they can do through sftp?
    – Kenster
    Jul 26, 2017 at 15:53
  • @Kenster I am attempting to prevent user1 from accessing sftp at all. Jul 26, 2017 at 16:02
  • What is your "Subsystem sftp" line? Is there a copy of the sftp-server program inside of the jail?
    – Kenster
    Jul 26, 2017 at 16:04
  • @Kenster It is a line that I read about within other posts, however it is not allowed within Match blocks. No there is no copy of the program within the jail Jul 26, 2017 at 16:24
  • So, uh, what is the actual subsystem sftp line in your actual sshd_config file?
    – Kenster
    Jul 26, 2017 at 16:28

1 Answer 1


The simplest way is to create some script that would take care of that. Add

Match User test1
  ForceCommand /path/to/your/script.sh

And your script will basically run whatever the user wants, unless it is request for SFTP:

if [[ "$SSH_ORIGINAL_COMMAND" =~ .*sftp-server.* ]]; then
   echo "SFTP not allowed"
   exit 255;
  • What should SSH_ORIGINAL_COMMAND be set to? At the moment it is not set to anything, which means that when the user is authenticated, ssh closes the connection immediately. Jul 28, 2017 at 11:49
  • It should be set to the sftp server path unless you have internal-sftp configured.
    – Jakuje
    Jul 28, 2017 at 13:31
  • I meant for the else exec part, where ssh should allow a connection. Jul 28, 2017 at 13:40
  • It is the variable set up by the ssh server. If it is allowed, it executes what user wanted
    – Jakuje
    Jul 28, 2017 at 15:16
  • for some reason it just closes the ssh connection without ever going into ssh. Aug 2, 2017 at 12:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .