Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to set up a user on ubuntu with openssh so that ssh does not use password authentication but sftp does?

I assume that if I change /etc/ssh/ssh_config to have PasswordAuthentication yes this makes is possible for users to use passwords to login with both ssh and sftp.

Edit: My purpose here is to let some users sftp with a password instead of a keyfile. But I do not want ssh users to be able to login with a password, I want them to have to use a keyfile. If it helps, I do not need the sftp users to be able to login, they only need to do sftp.

share|improve this question

3 Answers 3

up vote 13 down vote accepted

As I understand you have (at least for this particular problem) two distinct groups of users, one being able to login via SSH and get an interactive shell (let's call the group ssh) and one being able to login via SFTP and only get an SFTP shell (let's call the group sftp).

Now create the groups ssh and sftp on your system with groupadd, put the respective users in the groups (gpasswd -a $USERNAME $GROUPNAME) and append the following lines at the end (this is important!) of your sshd_config located at /etc/ssh/sshd_config:

Match Group sftp
  PasswordAuthentication yes
  # Further directives for users in the "sftp" group

Match Group ssh
  PasswordAuthentication no
  # Further directives for users in the "ssh" group

Read about the Match directive in sshd_config(5) and about the allowed patterns in ssh_config(5).

You'll also have to restart the ssh process for this to take effect:

sudo /etc/init.d/ssh restart

share|improve this answer
4  
This isn't well documented, but only one Match directive will be used; you should put the most specific directive on top. If you list sftp first, a user who is in both groups will be allowed PasswordAuthentication. –  Tobu Jun 26 '10 at 10:41
    
Thanks! There's already a ssh group on my ubuntu boxes, so I really only need to add sftp and put the sftp users into that group. I'll combine your answer with using scponly to keep the sftp users from logging in. –  dar Jun 26 '10 at 11:54
1  
If PasswordAuthentication is set to no further up, will this still work? Does Match Group override it for sftp users? Because that's what I have and it doesn't work. I can ssh in with key, but can't as an sftp user. –  alphadogg Apr 10 '13 at 0:27

No, and I don't see how this would improve security, so what would be the point?

authorized_keys can allow different commands for different keys, if that's what you're after. Otherwise, you have the option of creating several accounts and using acls or sudo.

share|improve this answer
    
I'm not trying to improve security. I'm trying to make it easier for some users to use a password instead of a keyfile for sftp access. However, I do not want anyone to use a password for ssh access. –  dar Jun 25 '10 at 23:49
    
@dar OK; different accounts then. If they were the same account, someone knowing the sftp password could overwrite some profile file (.ssh/rc, .profile, .bashrc…) and get the same privileges as someone knowing the private key. –  Tobu Jun 26 '10 at 10:12

Taking a stab in the dark here, but you may find this thread interesting.

http://serverfault.com/questions/41212/it-is-fair-to-jail-my-sftp-users-to-their-home-directory

share|improve this answer
    
I don't see anything in there about PasswordAuthentication, correct me if I'm wrong. –  dar Jun 25 '10 at 23:49
    
No, you're correct. It wasn't clear what you wanted to do with SFTP vs SSH. I see from the other comment that you want users to use a password for SFTP but not for SSH. Why? –  Tyler K Jun 26 '10 at 0:37
    
Because these users that need to use sftp find keyfiles challenging, but they understand how to type in passwords. It boils down to a user experience issue for sftp. But I want to minimize the attack surface area by keeping passwords out of the ssh mix. –  dar Jun 26 '10 at 2:55
    
SFTP works by first opening a ssh tunnel, then transmitting files via FTP. You can't really divorce the two. I guess you could by setting up some ACLs, but that doesn't really make sense. –  Tyler K Jun 26 '10 at 6:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.