-1

I've been doing my research and found some clues as to where I should be looking, but just can't quite get it perfect.

I'm trying to create a new user, and allow them to have access to SFTP for file management, but I do not want them to be able to SSH and access console. Nor am I trying to su the account.

I've tried changing their bash to (/bin/nologin), but then they cannot login to SFTP, I've tried locking their account as well but that didn't work either.

I'm on Centos 6, and I'm just using the built in sftp service.

Similar to probably how a small server host would set it up, allowing access to a specific directory, but not console. Just trying to project my butt if one of my server staff tries to railroad me.

Improve this question
3
  • 2
    "Just trying to project my butt if one of my server staff tries to railroad me." Sounds like you don't trust your employees. Why give them access to the server at all? No matter what safeguards you put in place, if someone wants to mess up things for you, they will do so, regardless of technological barriers you put in place. It's probably worth considering whether or not you want to employ people you don't trust.
    – EEAA
    Apr 15, 2015 at 18:59
  • They're people I trust, but just because I trust them doesn't mean I need to open up everything. You have a valid point, and it's not like they have root permissions, so even if they logged in there's not a whole lot they could do, just trying to close open doors is all. The door may not be indestructible, but at least it's locked. This is really intended for a "boss somebody else accessed my acct" situation. I trust the people I'm making accounts for, I don't like risk that's all.
    – Solistica
    Apr 15, 2015 at 19:08
  • How would allowing ssh allow users to act as others? Are they sudoers or do you have 777 (going to heaven) filesystem?
    – Esa Jokinen
    Apr 15, 2015 at 19:20

1 Answer 1

Reset to default
0

You have a couple of options here, you can specify commands that can be executed in the authorized_keys file (if you are using public/private keys)

Here is an article which talks about this method:

http://cybermashup.com/2013/05/14/restrict-ssh-logins-to-a-single-command/

The second way to skin this cat is to give the user account a restricted shell. In most restricted shell setups users can only run things that exist in their home directory. You'd need to copy your /etc/ssh files and also /usr/bin/sftp to the users home directory, but then they would only be able to execute commands you put in their home dir.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .