16

I have added a user to the system via the adduser tool. Then, in /etc/passwd, I tried changing the /bin/bash to /sbin/nologin or to /dev/null, but neither of these worked.

I would like the user not having the option to get an interactive shell, and just to use sftp. Is there a way?

I know it's been asked here before but it seems no-one gave a satisfactory response.

2
  • What do you mean by "no luck"? May 12, 2011 at 11:57
  • I meant that the remote scp / sftp didn't work. I solved it using the scponly shell as suggested by Iain
    – Toni Rosa
    May 12, 2011 at 13:42

4 Answers 4

11

The command you should use to change the shell is chsh. The nologin shell can be /sbin/nologin or /usr/sbin/nologin (check which you have by looking in /etc/shells) but /bin/false would probably be a better choice.

chsh -s /bin/false user

You should consider setting up something like scponly which will do exactly what you want.

5
  • Thanks for your answer. I have tried with the shells inside /etc/shell with no luck... /bin/false gives a "lost connection" and /sbin/nologin returns a "This account is currently not available.". I will try this scponly
    – Toni Rosa
    May 12, 2011 at 12:47
  • I solved it using the scponly shell! Cheers
    – Toni Rosa
    May 12, 2011 at 12:59
  • 3
    This answer is the needle in the hay! Make sure /bin/false and /bin/nologin are actually available in /etc/shells!
    – q9f
    Apr 14, 2016 at 11:10
  • @Afri Fine, but... you'll really want to read serverfault.com/questions/328395/… . This is pretty strongly contraindicated.
    – Reinderien
    Feb 19, 2019 at 1:40
  • @Afr don't put nologin in /etc/shells! serverfault.com/a/328424 Nov 26, 2019 at 10:50
13

You should also be able to do it with OpenSSH 4.9 and up, with which you can additionally chroot the user for increased security.

In your /etc/ssh/sshd_config:

Match User user
ChrootDirectory /home/user
ForceCommand internal-sftp
AllowTcpForwarding no

Then run:

chsh -s /bin/false user
chown root:root /home/user
mkdir /home/user/uploads
chown user /home/user/uploads

The user will only be able to write in /home/user/uploads.

https://debian-administration.org/article/590/OpenSSH_SFTP_chroot_with_ChrootDirectory

3
  • +1 I've put this on my list to investigate.
    – user9517
    May 12, 2011 at 14:11
  • 1
    I've used it and it works just fine - you can also give the user a choice to log in to the chroot environment with a shell, but in that case you have to copy a minimum of libraries and some other utilities as expected. Jailkit (olivier.sessink.nl/jailkit) comes in handy for that. May 12, 2011 at 14:14
  • Thanks, ForceCommand was a hint. I don't need chroot, but I do want to login to SFTP with service accounts.
    – AnrDaemon
    Nov 16, 2018 at 15:06
2

I think the best way is with mysecureshell

http://mysecureshell.sourceforge.net/en/index.html

You can chroot a user with this easily and even limit bandwidth if needed.

1
  • I solved it using the scponly shell, but It's interessant to know this mysecureshell
    – Toni Rosa
    May 12, 2011 at 12:59
1

You can add a user with -s /bin/false to disable their shell, but what you really should look into setting up is a chrooted sftp acccount. This will "jail" a user into their own directory and prevent them from being able to access or modify any files or directories outside of the chroot directory.

1
  • 2
    Thanks for your answer, but It doesn't seem to work. I get a "lost connection" whenever I try a user using the shell /bin/false.
    – Toni Rosa
    May 12, 2011 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .