How can I disable login for a user on OS X but still allow them to scp files to/from that machine?

I've come across a shell replacement "scponly" but that doesn't compile for OS X (and is really old), I've also tried changing the users shell to /sbin/nologin and /usr/bin/false, both successfully prevent logins, but they also prevent scp's...

Any hints?


  • Balt

1 Answer 1


Openssh does not have this functionality. As it provides the means for sftp, scp, and ssh, in an, all or nothing fashion.

rssh could be your solution then.

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs

It seems this is not possible without basically making a chroot environment. (Which ftp servers do, as do these shells).

Have you thought of using FTPS? (vsftpd requires little configuration and provides a jail for the users. Setup Guide Here)

  • rssh works, many thanks! For posteriority: on OS X, simply ./configure && make && sudo make install will do the job. Then copy /usr/local/etc/rssh.conf.default to /usr/local/etc/rssh.conf, edit to allow scp, set the users shell to rssh: sudo chsh -s /usr/local/bin/rssh <username> and done!
    – Balthasar
    Sep 20, 2014 at 5:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.