43

I'm allowing a friend a local account on my machine, exclusively for SCP. Can I specify his account's shell as /bin/true, or in any other way limit the account, while still allowing SCP?

Improve this question

2 Answers 2

Reset to default
45

I recommend using rsync instead of scp. For users, it has many more useful features. On the server side, it comes with rrsync to allow synvc access inside a given directory, but no general shell access and no access to other directories.

Alternatively, you can restrict the account to only allow SFTP and not shell access. SFTP is a distinct access type in the SSH protocol, unlike rsync and scp which work by running a shell command on the server. (rrsync restricts access by only allowing one specific shell command, which only supports certain rsync transfers and nothing else.) SFTP access enables SFTP clients as well as SSHFS.

Historically, there were projects such as rssh and scponly, which you could set as user's shell, and then the user would only be able to run file copies and not get shell access. However, those projects are unmaintained and very likely insecure by now.

Improve this answer
3
  • 1
    So does this mean /bin/false or /bin/true wouldn't work - or only allow sftp? Commented Sep 8, 2011 at 15:40
  • 3
    @DannyStaple If a user's shell is set to /bin/false or other program that does nothing, neither scp nor sftp will work. For both commands, the SSH daemon fires off a shell command that runs a dedicated server process (scp -f or sftp-server). It needs a Bourne-style shell, or at least a close enough approximation (such as rssh which allows only these few commands through). Commented Sep 8, 2011 at 20:00
  • 1
    rssh no longer exists, they've pulled the code because they consider it unsafe to use. scponly hasn't been updated in a decade. Not looking promising anymore. Commented Sep 27, 2023 at 18:33
4

No, you don't. As Gilles pointed out, rssh works very nicely to this end, as does scponly. See also the discussion in this related question.

Improve this answer
1
  • 2
    They're still shells, as pointed out /bin/false will not work, neither will chmod 644 ksh. Commented Sep 9, 2011 at 7:55

You must log in to answer this question.