Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm writing a simple program to back-up some files to a Linux box. The transaction will take place over SSH and each copy of the program will have its own account on the Linux box that it will connect to.

My concern is that it's likely a user of the software will figure out their account name and password (which will be randomly generated beforehand) and want to connect to the box and play around.

I would like to disable their ability to do anything on that box besides what I would authorize the back-up software to do. That is, they only need to create new files and read old ones (no updates or deletes). They shouldn't need the ability to execute bc or a who or anything of the sort.

I've thought about trying to chroot each user into their home directory, but I'm kinda fuzzy on how to do all that.

Any suggestions on how to achieve this desired functionality?


share|improve this question
up vote 10 down vote accepted

The authorized_keys file for an account can specify a command to be used whenever a specific key is used for authentication. This will require you to set up authentication using keys instead of user/password- although imho that's a good thing to do anyway.

For example, gitosis uses this method to allow people to connect to a server using ssh to tunnel the git protocol, but not allow them to login. The authorized_keys manpage gives examples, e.g.:

    command="dump /home",no-pty,no-port-forwarding ssh-dss AAAAC3...51R==
share|improve this answer
Thanks this looks like the most elegant solution to implement! – mrduclaw Dec 16 '09 at 14:50

Use scponly with the chroot option. This will give the users a special chrooted login, with only the binaries you want them to use.


share|improve this answer

You can use rssh (, it's like scponly but supports scp, sftp , rsync & cvs

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.