Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I use SSH keys to allow passwordless logons to my box. I want to limit them to SFTP only.

I have the following in my authorized_keys file which appears to work:

command="internal-sftp" ssh-rsa ...

I can't seem to find a way around it...but I am no genius...am I actually secure?

share|improve this question
Do you allow password authentication at all? –  Aaron Miller May 1 '13 at 14:07
No...nobody knows the password. –  Cheetah May 1 '13 at 14:33
That's not what I asked. In /etc/ssh/sshd_config or equivalent, is PasswordAuthentication set to yes or to no? –  Aaron Miller May 1 '13 at 15:04
@AaronMiller set to yes, but I can set that from the authorized_keys file though can't i? –  Cheetah May 4 '13 at 10:10
Doesn't look that way from the documentation, no. I'd turn it off in sshd_config; when you set the forced command in authorized_keys, it applies only to connections authenticated with that key. If you have password authentication enabled, logging in with the password will produce a shell as usual, so (for example) someone who runs a successful dictionary attack can still hose you pretty bad. –  Aaron Miller May 4 '13 at 16:43
show 1 more comment

1 Answer

You should better also remove the password from the account (no matter that "nobody knows the password").

passwd --delete username

Other than that your solution seems ok.

share|improve this answer
Sorry, I should have made it clearer. It already is a passwordless account. –  Cheetah May 7 '13 at 14:01
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.