Allow SCP but not actual login using SSH

Question

Is there any way to configure a user on a Linux box (Centos 5.2 in this case) so that they can use scp to retrieve files, but can't actually login to the server using SSH?

Answer 1

rssh (http://pizzashack.org/rssh/) is designed for precisely this purpose.

Since RHEL/CentOS 5.2 doesn't include a package for rssh, you might look here to obtain an RPM: http://dag.wieers.com/rpm/packages/rssh/

Answer 2

I'm a bit late to the party, however I will suggest you take a look at the ForceCommand directive of OpenSSH.

Subsystem sftp internal-sftp

Match group sftponly
         ForceCommand internal-sftp

Granted, this is SFTP and not SCP, but it reaches the same goal, more securely than with a restricted shell. Additionally, you can chroot the user if you want to.

Answer 3

I use MySecureShell to do this. You can configure other restrictions too.

http://mysecureshell.sourceforge.net/

Limits connections to SFTP/SCP only. No shell access.

Answer 4

We use a psudo shell called scponly on our secure ftp servers for users we only want to be able to scp files but not log in.

Answer 5

I'm way late to this but you could use ssh keys and specify the exact command allowed in their ~/.ssh/authorized_keys file e.g.

no-port-forwarding,no-pty,command="scp source target" ssh-dss ...

You may need to use ps to on the target to set the right command settings.

Answer 6

I'd recommend using scponly.

It is a restricted shell that allows users to do just what it sounds like, SCP files to the server, but not actually log in. Information and source code downloads for the software are available here and the pre-compiled RPM packages are available via the EPEL YUM Repositories.

Once installed, you will need to configure each user account, which you wish to restrict access to, to use the newly installed restricted shell. You can do this manually via /etc/passwd or use the following command: usermod -s /usr/bin/scponly USERNAME

Answer 7

Its not the most graceful solution, but you could throw something like this into the users .bashrc

if [ "$TERM"  != "dumb" ]; then
  exit
fi

I've found that SCP users get a TERM of 'dumb', and others will typically get vt100.

I imagine the user could probably scp over a new .bashrc, which makes this not the best solution, but for a quick and dirty solution, this will work