Allow SSH but disallow SFTP to a particular user group. Once disallowed, if the user group tries to access SFTP, it should not be allowed and all connections should be closed and the user should get the prompt back.

Current situation:

I'm able to disallow a particular user group using a Match block and Forcecommand. But not able to get the prompt back once login fails.


abcd> sftp usergroup@X.X.X.X [Does not allow but it remains in a hang state]

Need to press Ctlr C to get back the prompt (abcd>)


abcd> sftp usergroup@X.X.X.X [Fails next line prompt should be back]

I want to know if it is possible, if yes share your inputs.

  • 7
    Why do you want to do this in the first place? If users have shell access they can copy/move file as desired. What's the benefit of disallowing sftp then? – Marco Sep 21 '13 at 9:10
  • The concerned user group should not have access. That is requirement for security purpose. – MaxintowN Sep 21 '13 at 9:18
  • 2
    "Security purpose" says nothing. What is the real reason? After all, if these users cannot be allowed to transfer files, then they should not be allowed to access the system at all. – Michael Hampton Sep 21 '13 at 11:48
  • 2
    note that copying a file a user has the permission to read on a remote system is a no-brainer as long as the user has ssh access at all - no matter if SFTP- or SCP-related commands are available: # ssh user@remote.host 'cat /etc/passwd' > ~/passwd.remote.host – the-wabbit Sep 21 '13 at 12:00
  • 1
    I can only tell you how to allow sftp but disallow a shell. The other way around does not really make sense to me. – Nils Sep 21 '13 at 21:30

Disregarding the question title and instead focusing on the question in the comments:

The concerned user group should not have access. That is requirement for security purpose.

there is a fairly simple solution. Assuming OpenSSH (other software should have similar configuration options), edit /etc/ssh/sshd_config and add or augment the directives:

  • AllowUser
  • AllowGroup
  • DenyUser
  • DenyGroup

For example, to deny all access for users belonging to the group "no-ssh", you'd add:

DenyGroup no-ssh

The reverse, allow access for users belonging to the group "ssh", can be done similarly:

AllowGroup ssh

See the discussion in the man page about the relative priority of these directives and what patterns are supported.

The authentication rejection will be done on the protocol level so you should get an error message like "access denied" and be returned to where you were if you try.

Just be careful to not lock yourself out.


I see two possibilities - none of them tested:

  1. change your lokal sftp-binary to a special group, make it executable by that group, not others. Only users allowed for sftp are members of that group.
  2. change sftp to "internal" and activate a non-working chroot-environment for the group that is to be blocked.

if you want to disallow SFTP but allow SSH, just comment the follow line:

 Subsystem sftp /usr/lib/openssh/sftp-server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.