16

I have added a user to the system via the adduser tool. Then, in /etc/passwd, I tried changing the /bin/bash to /sbin/nologin or to /dev/null, but neither of these worked.

I would like the user not having the option to get an interactive shell, and just to use sftp. Is there a way?

I know it's been asked here before but it seems no-one gave a satisfactory response.

2
  • What do you mean by "no luck"? May 12, 2011 at 11:57
  • I meant that the remote scp / sftp didn't work. I solved it using the scponly shell as suggested by Iain
    – Toni Rosa
    May 12, 2011 at 13:42

4 Answers 4

11

The command you should use to change the shell is chsh. The nologin shell can be /sbin/nologin or /usr/sbin/nologin (check which you have by looking in /etc/shells) but /bin/false would probably be a better choice.

chsh -s /bin/false user

You should consider setting up something like scponly which will do exactly what you want.

5
  • Thanks for your answer. I have tried with the shells inside /etc/shell with no luck... /bin/false gives a "lost connection" and /sbin/nologin returns a "This account is currently not available.". I will try this scponly
    – Toni Rosa
    May 12, 2011 at 12:47
  • I solved it using the scponly shell! Cheers
    – Toni Rosa
    May 12, 2011 at 12:59
  • 3
    This answer is the needle in the hay! Make sure /bin/false and /bin/nologin are actually available in /etc/shells!
    – q9f
    Apr 14, 2016 at 11:10
  • @Afri Fine, but... you'll really want to read serverfault.com/questions/328395/… . This is pretty strongly contraindicated.
    – Reinderien
    Feb 19, 2019 at 1:40
  • @Afr don't put nologin in /etc/shells! serverfault.com/a/328424 Nov 26, 2019 at 10:50
12

You should also be able to do it with OpenSSH 4.9 and up, with which you can additionally chroot the user for increased security.

In your /etc/ssh/sshd_config:

Match User user
ChrootDirectory /home/user
ForceCommand internal-sftp
AllowTcpForwarding no

Then run:

chsh -s /bin/false user
chown root:root /home/user
mkdir /home/user/uploads
chown user /home/user/uploads

The user will only be able to write in /home/user/uploads.

https://debian-administration.org/article/590/OpenSSH_SFTP_chroot_with_ChrootDirectory

3
  • +1 I've put this on my list to investigate.
    – user9517
    May 12, 2011 at 14:11
  • 1
    I've used it and it works just fine - you can also give the user a choice to log in to the chroot environment with a shell, but in that case you have to copy a minimum of libraries and some other utilities as expected. Jailkit (olivier.sessink.nl/jailkit) comes in handy for that. May 12, 2011 at 14:14
  • Thanks, ForceCommand was a hint. I don't need chroot, but I do want to login to SFTP with service accounts.
    – AnrDaemon
    Nov 16, 2018 at 15:06
2

I think the best way is with mysecureshell

http://mysecureshell.sourceforge.net/en/index.html

You can chroot a user with this easily and even limit bandwidth if needed.

1
  • I solved it using the scponly shell, but It's interessant to know this mysecureshell
    – Toni Rosa
    May 12, 2011 at 12:59
1

You can add a user with -s /bin/false to disable their shell, but what you really should look into setting up is a chrooted sftp acccount. This will "jail" a user into their own directory and prevent them from being able to access or modify any files or directories outside of the chroot directory.

1
  • Thanks for your answer, but It doesn't seem to work. I get a "lost connection" whenever I try a user using the shell /bin/false.
    – Toni Rosa
    May 12, 2011 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.