Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have added a user to the system via the adduser tool. Then, in /etc/passwd, I tried changing the /bin/bash to /sbin/nologin or to /dev/null, but neither of these worked.

I would like the user not having the option to get an interactive shell, and just to use sftp. Is there a way?

I know it's been asked here before but it seems no-one gave a satisfactory response.

share|improve this question
What do you mean by "no luck"? – Paweł Brodacki May 12 '11 at 11:57
I meant that the remote scp / sftp didn't work. I solved it using the scponly shell as suggested by Iain – arosa May 12 '11 at 13:42
up vote 6 down vote accepted

The command you should use to change the shell is chsh. The nologin shell can be /sbin/nologin or /usr/sbin/nologin (check which you have by looking in /etc/shells) but /bin/false would probably be a better choice.

chsh -s /bin/false user

You should consider setting up something like scponly which will do exactly what you want.

share|improve this answer
Thanks for your answer. I have tried with the shells inside /etc/shell with no luck... /bin/false gives a "lost connection" and /sbin/nologin returns a "This account is currently not available.". I will try this scponly – arosa May 12 '11 at 12:47
I solved it using the scponly shell! Cheers – arosa May 12 '11 at 12:59
This answer is the needle in the hay! Make sure /bin/false and /bin/nologin are actually available in /etc/shells! – 5chdn Apr 14 at 11:10

You should also be able to do it with OpenSSH 4.9 and up, with which you can additionally chroot the user for increased security.

In your /etc/ssh/sshd_config:

Match User user
ChrootDirectory /home/user
ForceCommand internal-sftp
AllowTcpForwarding no

Then run:

chsh -s /bin/false user
chown root:root /home/user
mkdir /home/user/uploads
chown user /home/user/uploads

The user will only be able to write in /home/user/uploads.

share|improve this answer
+1 I've put this on my list to investigate. – Iain May 12 '11 at 14:11
I've used it and it works just fine - you can also give the user a choice to log in to the chroot environment with a shell, but in that case you have to copy a minimum of libraries and some other utilities as expected. Jailkit ( comes in handy for that. – Eduardo Ivanec May 12 '11 at 14:14

I think the best way is with mysecureshell

You can chroot a user with this easily and even limit bandwidth if needed.

share|improve this answer
I solved it using the scponly shell, but It's interessant to know this mysecureshell – arosa May 12 '11 at 12:59

You can add a user with -s /bin/false to disable their shell, but what you really should look into setting up is a chrooted sftp acccount. This will "jail" a user into their own directory and prevent them from being able to access or modify any files or directories outside of the chroot directory.

share|improve this answer
Thanks for your answer, but It doesn't seem to work. I get a "lost connection" whenever I try a user using the shell /bin/false. – arosa May 12 '11 at 12:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.