Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm starting a very little hosting company for a few friends and little clients, nothing big.

I want to give my "clients" the right to manage their files on the server. I hate FTP as it is not secure and it's in my opinion obsolete.

So I'd like to allow my users to connect through SFTP but not allow them to connect through SSH. (I know, I know, SFTP is using SSH). But I was just wondering, is it possible?

So I wouldn't have to install a FTP service on the server and everything would be awesome!

share|improve this question
up vote 74 down vote accepted

Starting with version 4.9 OpenSSH (not available in centos 5.x but ChrootDirectory feature was backported) has an internal-sftp subsystem:

Subsystem sftp internal-sftp

And then block other uses:

Match group sftponly
     ChrootDirectory /home/%u
     X11Forwarding no
     AllowTcpForwarding no
     ForceCommand internal-sftp

Add your users to the sftponly group. You have to change the user's homedirectory to / because of the chroot and /home/user should be owned by root. I'd also set /bin/false as the user's shell.

share|improve this answer
Wow! Super-awesome! I'll test this out and come back here to validate. Thanks a lot! – TomShreds Jan 28 '12 at 20:48
+1 for the ChrootDirectory thing! – Kyle Hodgson Jan 30 '12 at 18:30
After doing this, my sftponly user cant access by ssh and is able to connect by sftp. However it can't see any file at all! In spite these files have permission for this user. :-( – Emilio Nicolás Jan 15 '15 at 10:17
In case you want to do this and find an entry in your sshd_config with "/usr/lib/openssh/sftp-server" already existing, check here:… -- internal-sftp is "newer, better and easier" – Xosofox Jul 16 '15 at 10:57

There is a shell scponly what does this. It can chroot too.

share|improve this answer
This would come great if you need both SFTP users and SSH users. You just replace the shell in /etc/passwd for those restricted only to SFTP. – Dragos Feb 23 '12 at 8:12

Checkout rssh which is a fake shell that allows sftp but denies ssh

More about RSSH


You can configure rssh to allow / deny different behaviours like sft, scp etc.

share|improve this answer

You can modify /etc/passwd and give that user a fake shell so that he can not use ssh.

share|improve this answer
Did you test this? – splattne Jan 29 '12 at 8:49
When I try setting the shell to /bin/false neither ssh or sftp works – Brad Mace Mar 14 '13 at 22:34
/bin/false is to disallow any sort of login, that is not the correct approach here. The accepted answer from Rob Wouters' is how you should limit users to SFTP only, not by changing the shell. If you did want to change the shell @Stone's asnwer would be a good idea. – jwbensley Aug 7 '14 at 10:46

I use the method of specifying the user shell as /bin/false as mentioned. However, you must ensure that /bin/shell is in /etc/shells. Then it works ssh=no ftp=ok.

I also use vsftpd and add this
chroot_local_user=YES to /etc/vsftpd/vsftpd.conf so that ftp-ers can't see date other then their own.

Advantage to these simple changes are no annoying config to ssh config for each user.

share|improve this answer

Don't forget to find the line UsePAM yes and comment it:

#UsePAM yes

Without disabling this, your SSH server would crash on reloading/restarting. Since you do not need fancy functions of PAM, this is fine.

share|improve this answer

Configuring ssh to enable only sftp for some selected users is a good idea and it works properly, provided that you you install either scponly or rssh.

rssh works fine, unless you need to configure jail, in this case try to follow instruction provided by CHROOT manuals is crazy, leading to "copy" large parts of system executables and library just below "each user jail", including rssh shell itself. It is a space-wasting method.

scponly needs a deep understanding in configuration leading to ever-present problem of login rejection in case of jail setup.

The straightforward way to allow "ftp" functionalities with jail properly working, SSL/TLS support for secure transactions and login is to use an "old-but-working" VSFTPD, which installs quickly and cleanly and offers all configurability as needed and, last but not least: it works!


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.