Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a web app that allows our users to set up vendor SFTP accounts. We want our users to be able to manage the vendor accounts that can access their server in a reversible fashion, ie, without changing the password.

Would handing it via group membership be the best way to do it?

Users are currently chrooted and jailed to their home directory on login.

The machine is running Debian Squeeze (6.0.4) and OpenSSH_5.5p1

share|improve this question
I don't understand what you want to achieve? if you don't want to change passwords what is you want to allow your users to enable / disable / change? – AngryWombat Aug 19 '13 at 23:02
Am I understanding you correctly that your users should be able to temporarily disable SFTP access for a certain vendor, without deleting the vendor's password (and thus having to create a new one when re-activating the account)? – Aug 19 '13 at 23:11 - yes, exactly that. – yubus Aug 19 '13 at 23:12
@AngryWombat - the web app part may not be pertinent to the question. I'm the backend dev dealing with the implementation, so it made sense for me to add that. – yubus Aug 19 '13 at 23:15
@EricB - Then yes, creating either a whitelist or blacklist group for the enabled/disabled vendor accounts is likely a good approach. – Aug 19 '13 at 23:16
up vote 0 down vote accepted

My answers are is based on the premise that you're using system user accounts to manage sftp users.

  1. passwd --lock johndoe and passwd --unlock johndoe (won't take into account SSH keys, but the manpage passwd(1) offers a workaround
  2. remove the user's system account and save the password hash from /etc/master.passwd, then recreate the user once it's enabled
  3. modify the user's login shell to point to either /bin/noshell or an executable script that bounces them out with an error immediately or informative message
  4. create a group "whitelist" and a group "blacklist" - add sftp users to either group. modify group permissions accordingly to allow one to execuete /usr/libexec/sftp-server or whatever accordingly and one not
share|improve this answer
Thank you for suggestion #1. It is exactly what I was looking for. – yubus Aug 20 '13 at 23:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.