Can I set up accounts that can do SCP that are NOT local users (i.e. users with an entry in /etc/passwd)? I've tried googling for SCP "without PAM authentication" or alternative authenication for sshd but I have not yet found anything that I can use.

In other words: How can I configure SCP access on my Debian machine without having to create a new local account/local user?

Doing this would be useful example in the case of a webhost with several VirtualHost entries in httpd.conf allowing people to securely upload their website assets without the admin having to create an account and setup SSHd to point to their htdocs directory as their home directory.

  • 4
    how are your website owners going to authenticate? password? stored where? public key? again, stored where? also, given that all vhost directories will be owned by the one user (e.g. www-data or apache), what's to stop webuserA from overwriting or downloading files belonging to webuserB? I've always taken advantage of the unix permission/ownership model and set up vhosts so that they have a dedicated user and home directory and (using e.g. apache2-mpm-itk) their site's scripts are run as that user, and all files belonging to a vhost are in their home dir, and owned by that user.
    – cas
    Commented Sep 18, 2012 at 11:37
  • 1
    You can have a script add user accounts automatically
    – wnrph
    Commented Sep 18, 2012 at 13:26
  • 1
    ssh need to native account. Commented Sep 18, 2012 at 21:55

1 Answer 1


ProFTPD can be used in the manner you describe; its mod_sftp module supports SCP and it can use a variety of user authentication mechanisms. Before jumping in, you should be cognizant of these facts:

  • You will be broadening the attack surface area of your server
  • ProFTPD has suffered more frequent and severe security vulnerabilities than OpenSSH in the past couple years
  • Your ProFTPD SCP service and OpenSSH cannot share port 22

I have personal experience using this solution at a large enterprise for the exact reason you outline -- remote users must not have local system accounts (a service requirement for that particular user base). The only additional caveat I'll add is that the configuration can be daunting to accomplish the same degree of user separation that typical system accounts offer. By the same token, ProFTPD's extremely flexible configuration offers more interesting access control possibilities than OpenSSH.

  • I've just implemented the same thing using ProFTPd. Seems to be working. Thanks Eli. Also if you could edit your answer with suggestions on how to mitigate the security risks posed by adding yet another daemon listening on a server, that would help a great deal. But I consider this question answered. Thanks again.
    – emk
    Commented Oct 9, 2012 at 8:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .