sshd_config, by default, login is allowed for all groups and users. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups. (found in the man page).
So, I have to configure the server in a "blacklist way" (all are allowed, then I explicitely define whom access can be denied).
Is there a way to do the opposite ? I want if a user can't connect to ssh, the sftp connection will be refused, except if he match a rule.
I set the default shell to
/bin/false (so classic ssh connection is disabled).
Locking the user (
usermod -L usersftp1) obviously prevent the user to use both sftp and ssh (which is fine for me).
I tried to use
DenyGroups !sftp directive to disallow user matching other than sftp but the usersftp1 (which does not belongs to the group sftp (primary nor supplementary) but it didn't work.
I configured my server to manage some sftp access (starting with
Subsystem sftp internal-sftp)
In /etc/passwd, the line
The ssh connection doesn't work (which is what I want), but I can connect through sftp (beside the fact I didn't allowed that user yet).
I want the default behavior to be "connection not allowed" if user has the
EDIT: more configuration details:
file /etc/passwd: usersftp1:x:50001:5001::/home/sftp/usersftp1:/bin/false file /etc/group: usersftp1:x:5001 file /etc/ssh/sshd_config: … Subsystem sftp internal-sftp -l INFO # This is commented, so no rules will be set for user "usersftp1" # Match user usersftp1 # X11Forwarding no # ChrootDirectory %h # AllowTcpForwarding no # ForceCommand internal-sftp # This config works as expected Match user usersftp2 X11Forwarding no ChrootDirectory %h AllowTcpForwarding no ForceCommand internal-sftp
auth.log, I can see the user uses sftp :
Starting session: subsystem 'sftp' for usersftp1 from xxx.xxx.xxx.xxx port 55552
In that configuration, after
service ssh restart, users
usersftp2 can both connect using sftp (beside the fact the 1st one is commented)