sftp without ssh shell access?

1337

Is it possible to set up openssh so that some users would only be able to connect with a sftp client but wont have regular ssh shell access?

VoIP_n00b

https://tecadmin.net/create-sftp-only-user-centos/

scottalanmiller

Yes, it's actually the standard for SFTP servers.

1337

Thanks guys.

To summarize the link above, it's these lines in sshd_config that does the magic.

Match User sftpuser
     ForceCommand internal-sftp
     <snip>

The first line will tell sshd what user(s) the rest of the settings apply to.
The second line tells it to go straight into sftp mode. So this will only apply to the users that match the rule above.

black3dynamite

@Pete-S said in sftp without ssh shell access?:

Thanks guys.

To summarize the link above, it's these lines in sshd_config that does the magic.
Match User sftpuser
     ForceCommand internal-sftp
     <snip>
The first line will tell sshd what user(s) the rest of the settings apply to.
The second line tells it to go straight into sftp mode. So this will only apply to the users that match the rule above.

If possible, I would use Match Group instead.

dbeato

@Pete-S said in sftp without ssh shell access?:

Thanks guys.

To summarize the link above, it's these lines in sshd_config that does the magic.
Match User sftpuser
     ForceCommand internal-sftp
     <snip>
The first line will tell sshd what user(s) the rest of the settings apply to.
The second line tells it to go straight into sftp mode. So this will only apply to the users that match the rule above.

Just make sure to test SSH after you do the changes ok a new session otherwise you might just have broken SSH access.