I want to allow some users to only use SFTP but not SSH. Also I dont want these SFTP users ID and password to be stored in /etc/passwd file. I want their id and password details will be stored in a separate password file. I will use the pam_pwdfile module for SFTP authentication.

But the problem is I can't use pam_unix and pam_pwdfile at the same time to authenticate both SSH and SFTP user. How can I do that?

Any idea?

  • 1
    I suspect you can extract the username/password pairs from /etc/passwd and then have two pam_pwdfile entries in your PAM configuration (and no pam_unix entry). But the first thing I'd look at is why you "can't use pam_unix and pam_pwdfile at the same time". It's likely that by going down that route you will find a much less kludgy solution. – user Dec 2 '15 at 10:48
  • Suppose I have a user id "SFTPuser". PAM first check the username in /etc/passwd and could not find it there. It returns a failed authentication. It even does not check the second password file. But I have both pam_unix and pam_pwdfile modules included in my conf file – Saber Dec 2 '15 at 19:30

I had a similar problem. The solution I found was:

  1. create an authentication stand-alone lib
  2. use authentication lib in the pam module
  3. to create a custom NSS plugin (from this https://github.com/donapieppo/libnss-ato ) and check with the authentication lib to see which local user accounts to map to (e.g. : "ftp_restricted_user" or "full_access_user" depending on the username)

so basically, when a user tries to loggin with ssh or sftp, the NSS plugin is called and maps the requested user-id to the local unix account. Then PAM comes into play just to check if the credentials are ok.

Hope this helps..


You might be able use ProFTPD's mod_sftp module for this. It allows SFTP but not SSH2 access, and uses ProFTPD's multiple authentication backends (which means your user data can be stored in alternate password files, SQL databases, LDAP directories, etc), and does not necessarily need to use PAM.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.