Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My project needs me to disable sftp for some users, but those users still need to connect over ssh. Does anyone know how to implement this?

I've seen suggestions to change the file at /etc/ssh/sshd_config, but I'm not sure what to change.

share|improve this question

migrated from Jul 15 '11 at 19:49

This question came from our site for professional and enthusiast programmers.

This doesn't make any sense, it is security through useless obscurity. Any user that can SSH will be able to transfer any file that they are able to read via the SSH session. You will also be able to write, if you have permissions to do so.

As can example, you can download /etc/passwd via ssh using the following method (no scp/sftp session required): ssh "cat /etc/passwd" > passwdcopy

If you can see it on your screen via SSH, then you can easily copy it as a file.

The only way this would make sense is if you have a custom restricted shell that enforces a security policy.

However, the inverse of this does make sense (disabling ssh shell but leeaving scp/sftp enabled) because you are not able to execute arbitrary commands via sftp/scp that you can via an ssh shell.

PS: I'm assuming the SSH shell you are granting is a standard shell that allows arbitrary execution. If this is not the case then see this: How to disable sftp subsystem for a specific user or group? and take a look at the Subsystem config option of sshd_config.

share|improve this answer

In general doing this is bad security practice for reasons that others have listed. However, the point of your assignment, I think, is to teach you that you can have conditional config sections based on various criteria.

The way to do this is using a Match conditional block*.

Match User bob
Subsystem   sftp  /bin/false

See sshd_config(5) under the Match section for more information, and matching on Group.

*There's more than one way to do it.

share|improve this answer
It's not working for me. Error: Directive 'Subsystem' is not allowed within a Match block – cwo Jan 22 '13 at 9:38
Match Group nosft
Subsystem   sftp  /bin/false

I prefer to use a group for this.

It is useful in combination with users who have restricted shells. I sometimes give ssh access to a client so that they can access a sql-dump of their database by setting their shell to a script that dumps their data. Cutting them off from scp also seems to be a smart idea. They don't have access to running cat to transfer a file over ssh.

share|improve this answer
Directive 'Subsystem' is not allowed within a Match block – Patryk Dec 8 '14 at 10:33
Match User bob
MaxSessions 0

Tested and working on CentOS 6.6. Note that Subsystem is not allowed with Match at least on newer CentOS versions. The manpage for sshd_config lists the limited keywords that are allowed with the Match condition.

share|improve this answer

You can look at scponly to do the reverse, allow only scp/sftp but no shell access.

I agree with @Nathan above, this doesn't make a whole lot of sense. If you are dead set, try editting your /etc/ssh/sshd_config file and removing/commenting out the following line:

Subsystem sftp /usr/libexec/openssh/sftp-server

share|improve this answer

give no home directory for user

usermod username -d /bin/false

Change Subsystem sftp /usr/libexec/openssh/sftp-server in file /etc/ssh/sshd_config to Subsystem sftp /dev/null/usr/libexec/openssh/sftp-server

Then restart the ssh

service ssh restart

it works for me, debian.

share|improve this answer

In the ~/authorized_key configure the user key as follow:

command="/bin/bash" ssh-rsa AAAAB3Nz.........
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.