I'm allowing a friend a local account on my machine, exclusively for SCP. Can I specify his account's shell as /bin/true, or in any other way limit the account, while still allowing SCP?


You can set that user's shell to rssh or scponly, which are designed precisely for that purpose:

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs.

scponly is an alternative 'shell' (of sorts) for system administrators who would like to provide access to remote users to both read and write local files without providing any remote execution priviledges.

When you run scp, the OpenSSH daemon fires off an scp process with the -f option. When you run sftp, the OpenSSH daemon fires off an sftp-server process. In either case, the subprocess is executed through the user's shell, so that shell must support at least these commands, with a Bourne-like syntax. Any Bourne-style shell will do, as will csh (I think its quoting rules are compatible enough for what sshd uses). Rssh and scponly allow these commands and nothing else. /bin/true would not even run these commands.

  • So does this mean /bin/false or /bin/true wouldn't work - or only allow sftp? Sep 8 '11 at 15:40
  • 3
    @DannyStaple If a user's shell is set to /bin/false or other program that does nothing, neither scp nor sftp will work. For both commands, the SSH daemon fires off a shell command that runs a dedicated server process (scp -f or sftp-server). It needs a Bourne-style shell, or at least a close enough approximation (such as rssh which allows only these few commands through). Sep 8 '11 at 20:00

No, you don't. As Gilles pointed out, rssh works very nicely to this end, as does scponly. See also the discussion in this related question.

  • 1
    They're still shells, as pointed out /bin/false will not work, neither will chmod 644 ksh.
    – Steve-o
    Sep 9 '11 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy