We have some generic Ids for working on the Linux boxes. Recently we decided that the generic account will be locked out for logins and people will get individual IDs (which is always the best choice, so far auditing is concerned). The issue is, I am not able to figure out will this also ensure that scp connections which use this generic ID - will start to fail? Even though a trust relationship exist between source and destination servers, authentication and authorization is needed (As far as I think).

Can someone help me in figuring this out as to will scp connections be affected? And if they will, what alternatives I have to ensure that even though no one can login through that generic ID on the box, scp connections can be made.

Thanks, Ankur

  • 1
    Just try it yourself. Setup test environment similar to your one (if needed) and try to SCP in it.
    – Lavir the Whiolet
    Nov 2, 2010 at 20:18

2 Answers 2


I faced a situation where I wanted to give a client scp access to my linux box, but nothing else. To accomplish when I created the user account I specified it's shell environment to be rssh, or resticted shell. Then in the conf file (/etc/rssh.conf, can't remember) I turned off all connections except scp and/or sftp. To turn off a connection type, simply comment the line out with a "#".

Google for rssh and you can find the correct package you need.

Create restricted account:

 $ useradd -m -d /home/username -s /usr/bin/rssh username
  • 1
    Another option is scponly. It can restrict to just sftp or allow scp and a few other applications. It also supports chrooting, etc. Disclosure: I'm one of the maintainers. Nov 2, 2010 at 21:06

Just to be (a bit) different: lshell is a great way to annoy... I mean, restrict your users.

With it you can restrict some users or groups to scp/sftp only, and/or allow them to run only a handful of shell commands. If they have the nerve to run anything else, they get warned about that and then kicked out after entering not listed commands for more than X times. :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy