Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I have users transferring files to me using the same user account on my server and by adding their public keys to the authorised keys file.

I want to restrict access as much as possible, such that they should only be able to create files.

Is this possible?

share|improve this question

marked as duplicate by MadHatter, Sven, Tom O'Connor, Ladadadada, Dave M Apr 23 '13 at 12:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
What same account? yours? what you want is chrooted sftp –  dawud Apr 23 '13 at 10:10

2 Answers 2

Since they're logging in by using public keys, you can simply set that key to not allow any PTY. Here's an example of a fairly closed-down key:

from="their.workstation.only.domain.com",no-pty,no-port-forwarding ssh-dss AAA....

This will only allow connections from one computer and will disallow both PTY and port forwarding. All such options should come before the actual key starts and be separated by commas.

There's a list of all possible options in the section AUTHORIZED_KEYS FILE FORMAT in the man page for sshd.

share|improve this answer
    
Does no-pty prevent program execution? I don't think so: ssh -o RequestTTY=no foo@bar touch /tmp/testfile –  Hauke Laging Apr 23 '13 at 10:33
    
no-pty limits only tty, which disables a shell. There are other options in the man page to further limit what actions are possible. –  Jenny D Apr 23 '13 at 11:10

I think rssh is obviously choice.

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs. For example, if you have a server which you only want to allow users to copy files off of via scp, without providing shell access, you can use rssh to do that.

share|improve this answer
    
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. –  Tom O'Connor Apr 23 '13 at 10:59
    
Thank @TomO'Connor, just update my answer. –  favadi Apr 23 '13 at 11:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.