I have a Linux installation (Ubuntu 12.04), managed not only by me. I had restricted SSH access to a user using

/usr/sbin/usermod -s /bin/false my_user

This didn't allow neither SFTP access nor console access.

However today, I found out that users with this shell, do have SFTP access and I'm very sure they didn't have access in the past.

Could there be a config change which is allowing this? Unfortunately, I can't contact any of the others guys to see if any accidental changes were made.


It could be that you have

Subsystem       sftp    internal-sftp


Match Group sftpusers
   ChrootDirectory %h
   ForceCommand internal-sftp
   AllowTcpForwarding no


 Match User username
   ChrootDirectory %h
   ForceCommand internal-sftp

configured which will allow users sftp access even if they have a /bin/false shell. If you didn't set this up you could always audit the /var/log/audit.log etc to see who did it by looking for who made edits (everyone does use sudo don't they) to /etc/ssh/sshd_config and restarted the sshd service.

  • 1
    yes that was the problem! 10x! – Krt_Malta Aug 23 '12 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.