Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to allow a user to connect to a Mac OS X 10.5.7 Leopard box, and restrict them to log in only by SFTP, to a chrooted jail.

I've successfully configured OpenSSH using internal-sftp so the user can use sftp but not get a raw ssh session. To do that I created a user and added them to a group, then used a Match Group entry in sshd_config

However, the user is also showing up on the user selection screen at the console, and can log in interactively there.

I've modified the users UID to be 499, but that trick doesn't work on Leopard any more - and doesn't stop a user from typing the credentials in manually anyway.

Changing the user's shell doesn't seem to help either - it just prevents sftp from working.

Any ideas on how I can lock this user out of an interactive login?

share|improve this question

For not showing the user on the loginwindow you can use the defaults command:

defaults write /Library/Preferences/ Hide500Users -bool YES

However this won't stop them from entering their credentials if you use the username/password setting on loginwindow instead of clicking on a username.

share|improve this answer
Happy to up-vote since the advice works as far as it goes. However, I'm not going to accept it as the answer, since it doesn't actually close the security hole - just masks it a bit. – Bill Michell Jul 28 '09 at 8:11
It's security through obscurity! Because as everyone knows that stuff is unbreakable! ;-) – Chealion Jul 28 '09 at 15:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.