Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have added a user to the system via "adduser" script. Then, in the /etc/passwd file I tried changing the /bin/bash to /sbin/nologin or to /dev/null with no luck... I would like the user not having the option to get an interactive reconsole Is there a way?

I know it's been asked here before but it seems no-one gave a satisfactory response.

share|improve this question
    
What do you mean by "no luck"? –  Paweł Brodacki May 12 '11 at 11:57
    
I meant that the remote scp / sftp didn't work. I solved it using the scponly shell as suggested by Iain –  arosa May 12 '11 at 13:42
add comment

4 Answers

up vote 4 down vote accepted

The command you should use to change the shell is chsh. The nologin shell can be /sbin/nologin or /usr/sbin/nologin (check which you have by looking in /etc/shells) but /bin/false would probably be a better choice.

chsh -s /bin/false user

You should consider setting up something like scponly which will do exactly what you want.

share|improve this answer
    
Thanks for your answer. I have tried with the shells inside /etc/shell with no luck... /bin/false gives a "lost connection" and /sbin/nologin returns a "This account is currently not available.". I will try this scponly –  arosa May 12 '11 at 12:47
    
I solved it using the scponly shell! Cheers –  arosa May 12 '11 at 12:59
add comment

You should also be able to do it with OpenSSH 4.9 and up, with which you can additionally chroot the user for increased security.

In your /etc/ssh/sshd_config:

Match User user
ChrootDirectory /home/user
ForceCommand internal-sftp
AllowTcpForwarding no

Then run:

chsh -s /bin/false user
chown root:root /home/user
mkdir /home/user/uploads
chown user /home/user/uploads

The user will only be able to write in /home/user/uploads.

http://www.debian-administration.org/articles/590

share|improve this answer
    
+1 I've put this on my list to investigate. –  Iain May 12 '11 at 14:11
    
I've used it and it works just fine - you can also give the user a choice to log in to the chroot environment with a shell, but in that case you have to copy a minimum of libraries and some other utilities as expected. Jailkit (olivier.sessink.nl/jailkit) comes in handy for that. –  Eduardo Ivanec May 12 '11 at 14:14
add comment

You can add a user with -s /bin/false to disable their shell, but what you really should look into setting up is a chrooted sftp acccount. This will "jail" a user into their own directory and prevent them from being able to access or modify any files or directories outside of the chroot directory.

share|improve this answer
    
Thanks for your answer, but It doesn't seem to work. I get a "lost connection" whenever I try a user using the shell /bin/false. –  arosa May 12 '11 at 12:41
add comment

I think the best way is with mysecureshell

http://mysecureshell.sourceforge.net/en/index.html

You can chroot a user with this easily and even limit bandwidth if needed.

share|improve this answer
    
I solved it using the scponly shell, but It's interessant to know this mysecureshell –  arosa May 12 '11 at 12:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.