Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use SSH keys to allow passwordless logons to my box. I want to limit them to SFTP only.

I have the following in my authorized_keys file which appears to work:

command="internal-sftp" ssh-rsa ...

I can't seem to find a way around it...but I am no I actually secure?

share|improve this question
Do you allow password authentication at all? – Aaron Miller May 1 '13 at 14:07
No...nobody knows the password. – Cheetah May 1 '13 at 14:33
That's not what I asked. In /etc/ssh/sshd_config or equivalent, is PasswordAuthentication set to yes or to no? – Aaron Miller May 1 '13 at 15:04
@AaronMiller set to yes, but I can set that from the authorized_keys file though can't i? – Cheetah May 4 '13 at 10:10
Much better methods detailed on SF: – Ben Voigt Jul 24 '14 at 17:39

not really. One can just download the authorized_keys file, edit it removing the command="internal-sftp" part and upload it on top of yours and then ssh into the box.

share|improve this answer
Yes, changing the shell is also needed, chroot jail is also a good practice. And forwarding can be a vulnerability as well. – Ben Voigt Jul 24 '14 at 17:40

You should better also remove the password from the account (no matter that "nobody knows the password").

passwd --delete username

Other than that your solution seems ok.

share|improve this answer
Sorry, I should have made it clearer. It already is a passwordless account. – Cheetah May 7 '13 at 14:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.