How can I disable login for a user on OS X but still allow them to scp files to/from that machine?

I've come across a shell replacement "scponly" but that doesn't compile for OS X (and is really old), I've also tried changing the users shell to /sbin/nologin and /usr/bin/false, both successfully prevent logins, but they also prevent scp's...

Any hints?


  • Balt

1 Answer 1


Openssh does not have this functionality. As it provides the means for sftp, scp, and ssh, in an, all or nothing fashion.

rssh could be your solution then.

rssh is a restricted shell for use with OpenSSH, allowing only scp and/or sftp. It now also includes support for rdist, rsync, and cvs

It seems this is not possible without basically making a chroot environment. (Which ftp servers do, as do these shells).

Have you thought of using FTPS? (vsftpd requires little configuration and provides a jail for the users. Setup Guide Here)

  • rssh works, many thanks! For posteriority: on OS X, simply ./configure && make && sudo make install will do the job. Then copy /usr/local/etc/rssh.conf.default to /usr/local/etc/rssh.conf, edit to allow scp, set the users shell to rssh: sudo chsh -s /usr/local/bin/rssh <username> and done!
    – Balthasar
    Commented Sep 20, 2014 at 5:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .