I want to restrict all users on a server to only be able to use SFTP while the members of an admin group should have full SSH access.
I found that it is possible to restrict the members of a group by using
Match Group and
ForceCommand. But I found no logical negation. So I tried to construct it in reverse:
# SFTP only, full access only for admin group X11Forwarding no AllowTcpForwarding no ForceCommand internal-sftp Match Group admin X11Forwarding yes AllowTcpForwarding yes ForceCommand /usr/local/sbin/ssh-allowcmd.sh
and built a script
ssh-allowcmd.sh that executes either the given command or
/bin/bash for interactive access.
Is there a better solution?