I'm allowing a friend a local account on my machine, exclusively for SCP. Can I specify his account's shell as
/bin/true, or in any other way limit the account, while still allowing SCP?
I recommend using
rsync instead of
scp. For users, it has many more useful features. On the server side, it comes with
rrsync to allow
synvc access inside a given directory, but no general shell access and no access to other directories.
Alternatively, you can restrict the account to only allow SFTP and not shell access. SFTP is a distinct access type in the SSH protocol, unlike rsync and scp which work by running a shell command on the server. (rrsync restricts access by only allowing one specific shell command, which only supports certain rsync transfers and nothing else.) SFTP access enables SFTP clients as well as SSHFS.
Historically, there were projects such as
scponly, which you could set as user's shell, and then the user would only be able to run file copies and not get shell access. However, those projects are unmaintained and very likely insecure by now.