as the title said, i want to disallow ssh access for a user, but allow the user to execute a java process and access SFTP
How this can be done?
You can create a group called sftponly.
Add the user to this group and configure ssh
/etc/ssh/sshd_config
Added Conf:
Match Group sftponly
ChrootDirectory %h
AllowTCPForwarding no
X11Forwarding no
ForceCommand internal-sftp
Now the users in this group will only be able to sftp
There is a smal problem with this setup, is that chroot from ssh it needs that the %h (home variable) be owned by root. With this variablke you can do this for multiple users.
so it would be like this:
/home/user1 ( root owner )
/home/user1/public_html ( user1 owner )
Does not need to be public_html it can be any folder name... example Java
user1
Well, the easy way to disallow ssh access for most things is to change their shell environment variable in their profile. Check here: http://www.cyberciti.biz/faq/how-to-disable-shell-ftp-access-to-newuser/
If you want them to be able to access highly specific commands, check http://www.eng.cam.ac.uk/help/jpmg/ssh/authorized_keys_howto.html - you'll need to give them an authorized key (rather than a password), and follow the instructions in the "Forced command" section so that it'll always run the exact same command when they log in, ignoring whatever they send to it.
command=""
on login in the link of Roberts