16

Is it possible to set up a user on ubuntu with openssh so that ssh does not use password authentication but sftp does?

I assume that if I change /etc/ssh/ssh_config to have PasswordAuthentication yes this makes is possible for users to use passwords to login with both ssh and sftp.

Edit: My purpose here is to let some users sftp with a password instead of a keyfile. But I do not want ssh users to be able to login with a password, I want them to have to use a keyfile. If it helps, I do not need the sftp users to be able to login, they only need to do sftp.

Improve this question

3 Answers 3

Reset to default
27

As I understand you have (at least for this particular problem) two distinct groups of users, one being able to login via SSH and get an interactive shell (let's call the group ssh) and one being able to login via SFTP and only get an SFTP shell (let's call the group sftp).

Now create the groups ssh and sftp on your system with groupadd, put the respective users in the groups (gpasswd -a $USERNAME $GROUPNAME) and append the following lines at the end (this is important!) of your sshd_config located at /etc/ssh/sshd_config:

Match Group sftp
  PasswordAuthentication yes
  # Further directives for users in the "sftp" group

Match Group ssh
  PasswordAuthentication no
  # Further directives for users in the "ssh" group

Read about the Match directive in sshd_config(5) and about the allowed patterns in ssh_config(5).

You'll also have to restart the ssh process for this to take effect:

sudo /etc/init.d/ssh restart

Improve this answer
3
  • 6
    This isn't well documented, but only one Match directive will be used; you should put the most specific directive on top. If you list sftp first, a user who is in both groups will be allowed PasswordAuthentication.
    – Tobu
    Jun 26, 2010 at 10:41
  • Thanks! There's already a ssh group on my ubuntu boxes, so I really only need to add sftp and put the sftp users into that group. I'll combine your answer with using scponly to keep the sftp users from logging in.
    – dar
    Jun 26, 2010 at 11:54
  • 4
    If PasswordAuthentication is set to no further up, will this still work? Does Match Group override it for sftp users? Because that's what I have and it doesn't work. I can ssh in with key, but can't as an sftp user.
    – alphadogg
    Apr 10, 2013 at 0:27
0

No, and I don't see how this would improve security, so what would be the point?

authorized_keys can allow different commands for different keys, if that's what you're after. Otherwise, you have the option of creating several accounts and using acls or sudo.

Improve this answer
2
  • I'm not trying to improve security. I'm trying to make it easier for some users to use a password instead of a keyfile for sftp access. However, I do not want anyone to use a password for ssh access.
    – dar
    Jun 25, 2010 at 23:49
  • @dar OK; different accounts then. If they were the same account, someone knowing the sftp password could overwrite some profile file (.ssh/rc, .profile, .bashrc…) and get the same privileges as someone knowing the private key.
    – Tobu
    Jun 26, 2010 at 10:12
0

Taking a stab in the dark here, but you may find this thread interesting.

It is fair to jail my SFTP users to their home directory?

Improve this answer
4
  • I don't see anything in there about PasswordAuthentication, correct me if I'm wrong.
    – dar
    Jun 25, 2010 at 23:49
  • No, you're correct. It wasn't clear what you wanted to do with SFTP vs SSH. I see from the other comment that you want users to use a password for SFTP but not for SSH. Why?
    – Tyler K
    Jun 26, 2010 at 0:37
  • Because these users that need to use sftp find keyfiles challenging, but they understand how to type in passwords. It boils down to a user experience issue for sftp. But I want to minimize the attack surface area by keeping passwords out of the ssh mix.
    – dar
    Jun 26, 2010 at 2:55
  • SFTP works by first opening a ssh tunnel, then transmitting files via FTP. You can't really divorce the two. I guess you could by setting up some ACLs, but that doesn't really make sense.
    – Tyler K
    Jun 26, 2010 at 6:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .