I have a user on my Linux system that is only allowed to use SSH to scp, sftp and rsync, but not allowed to have a shell session in a SSH session. I want to know a secure way to setup the restriction.

A typical answer is to restrict the user's shell, setting in /etc/passwd the default shell to rssh. However, changing the default shell apparently also affects other applications that depend on the SHELL environment variable. For example, on the latest Fedora 22, it seems to affect the less command, which invokes the default shell, so the user will get a weird warning from rssh when he runs the less command (e.g. when being sudoed by another user, not connected through SSH). There could be other programs that are affected in bigger and more dramatic ways.

Setting the user's authorized_keys to restrict the program to run doesn't actually work, because he can use sftp/scp to change it to something not restrictive.

So, what's another way to restrict the user's access?

  • 1
    And this doesn't help you? – Run CMD Dec 15 '15 at 12:11
  • scp, sftp and rsync are quire different tools. You can simply limit to use only sftp, but the other two are more complicated since both of them issue normal commands in remote shell. – Jakuje Dec 15 '15 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.