I'm starting a very little hosting company for a few friends and little clients, nothing big.

I want to give my "clients" the right to manage their files on the server. I hate FTP as it is not secure and it's in my opinion obsolete.

So I'd like to allow my users to connect through SFTP but not allow them to connect through SSH. (I know, I know, SFTP is using SSH). But I was just wondering, is it possible?

So I wouldn't have to install a FTP service on the server and everything would be awesome!


Starting with version 4.9 OpenSSH (not available in centos 5.x but ChrootDirectory feature was backported) has an internal-sftp subsystem:

Subsystem sftp internal-sftp

And then block other uses:

Match group sftponly
     ChrootDirectory /home/%u
     X11Forwarding no
     AllowTcpForwarding no
     ForceCommand internal-sftp

Add your users to the sftponly group. You have to change the user's homedirectory to / because of the chroot and /home/user should be owned by root. I'd also set /bin/false as the user's shell.

  • Wow! Super-awesome! I'll test this out and come back here to validate. Thanks a lot! – Tommy B. Jan 28 '12 at 20:48
  • +1 for the ChrootDirectory thing! – Kyle Hodgson Jan 30 '12 at 18:30
  • 1
    After doing this, my sftponly user cant access by ssh and is able to connect by sftp. However it can't see any file at all! In spite these files have permission for this user. :-( – Emilio Nicolás Jan 15 '15 at 10:17
  • 3
    In case you want to do this and find an entry in your sshd_config with "/usr/lib/openssh/sftp-server" already existing, check here: serverfault.com/questions/660160/… -- internal-sftp is "newer, better and easier" – Xosofox Jul 16 '15 at 10:57

There is a shell scponly what does this. It can chroot too.

  • This would come great if you need both SFTP users and SSH users. You just replace the shell in /etc/passwd for those restricted only to SFTP. – Dragos Feb 23 '12 at 8:12

Checkout rssh which is a fake shell that allows sftp but denies ssh

More about RSSH




You can configure rssh to allow / deny different behaviours like sft, scp etc.

  • Nice. This is the easiest way to config without touching sshd_config at all. Just change the shell in passwd file and done. – Tomofumi Aug 22 '18 at 7:47

You can modify /etc/passwd and give that user a fake shell so that he can not use ssh.

  • 11
    Did you test this? – splattne Jan 29 '12 at 8:49
  • 8
    When I try setting the shell to /bin/false neither ssh or sftp works – Brad Mace Mar 14 '13 at 22:34
  • 2
    /bin/false is to disallow any sort of login, that is not the correct approach here. The accepted answer from Rob Wouters' is how you should limit users to SFTP only, not by changing the shell. If you did want to change the shell @Stone's asnwer would be a good idea. – jwbensley Aug 7 '14 at 10:46
  • 1
    so WHAT shell should be used assuming /bin/bash is not acceptable and /bin/false or /sbin/nologin deny access? – Putnik Nov 20 '17 at 23:07

I use the method of specifying the user shell as /bin/false as mentioned. However, you must ensure that /bin/shell is in /etc/shells. Then it works ssh=no ftp=ok.

I also use vsftpd and add this
chroot_local_user=YES to /etc/vsftpd/vsftpd.conf so that ftp-ers can't see date other then their own.

Advantage to these simple changes are no annoying config to ssh config for each user.


Don't forget to find the line UsePAM yes and comment it:

#UsePAM yes

Without disabling this, your SSH server would crash on reloading/restarting. Since you do not need fancy functions of PAM, this is fine.


Configuring ssh to enable only sftp for some selected users is a good idea and it works properly, provided that you you install either scponly or rssh.

rssh works fine, unless you need to configure jail, in this case try to follow instruction provided by CHROOT manuals is crazy, leading to "copy" large parts of system executables and library just below "each user jail", including rssh shell itself. It is a space-wasting method.

scponly needs a deep understanding in configuration leading to ever-present problem of login rejection in case of jail setup.

The straightforward way to allow "ftp" functionalities with jail properly working, SSL/TLS support for secure transactions and login is to use an "old-but-working" VSFTPD, which installs quickly and cleanly and offers all configurability as needed and, last but not least: it works!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.