0

as the title said, i want to disallow ssh access for a user, but allow the user to execute a java process and access SFTP

How this can be done?

2
  • Have you thought about FTPS? jscape.com/blog/bid/75602/… Sep 16, 2013 at 14:09
  • You probably need two users to achieve this securely and easily. One user with the sftp access Henrique describes, A second with a authorized_key file that will run the the specific command="" on login in the link of Roberts
    – Matt
    Sep 16, 2013 at 17:09

2 Answers 2

2

You can create a group called sftponly.

Add the user to this group and configure ssh

/etc/ssh/sshd_config

Added Conf:

Match Group sftponly
    ChrootDirectory %h
    AllowTCPForwarding no
    X11Forwarding no
    ForceCommand internal-sftp 

Now the users in this group will only be able to sftp

There is a smal problem with this setup, is that chroot from ssh it needs that the %h (home variable) be owned by root. With this variablke you can do this for multiple users.

so it would be like this:

/home/user1   ( root owner )
/home/user1/public_html ( user1 owner )

Does not need to be public_html it can be any folder name... example Java

1
  • OP needs to execute a command as well. This config won't allow that for user1
    – Matt
    Sep 16, 2013 at 17:03
0

Well, the easy way to disallow ssh access for most things is to change their shell environment variable in their profile. Check here: http://www.cyberciti.biz/faq/how-to-disable-shell-ftp-access-to-newuser/

If you want them to be able to access highly specific commands, check http://www.eng.cam.ac.uk/help/jpmg/ssh/authorized_keys_howto.html - you'll need to give them an authorized key (rather than a password), and follow the instructions in the "Forced command" section so that it'll always run the exact same command when they log in, ignoring whatever they send to it.

1
  • I know how to edit the shell to nologin, but I need shell access to execute the Java process, as i stated in the question. A process can be executed without a shell?
    – CappyT
    Sep 16, 2013 at 14:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .