I got an interesting question today. Our client needs to access to the server via SFTP, but they want to disable to the access to the SSH shell. Assuming that you are fully aware of the potential issues of doing it, such ask security risk etc, here is how to do it:<\/p>\n
<\/div>\n
\r\n#Create a user account as usual, e.g.,\r\nsudo adduser sftpuser\r\n\r\n#Edit the User Password Profile\r\nsudo vipw\r\n\r\n\r\n#Type i to switch to the editor mode\r\n\r\n#Replace the shell of the user to the following based on your OS:\r\nLinux: \/usr\/libexec\/openssh\/sftp-server\r\nFreeBSD: \/usr\/libexec\/sftp-server\r\n\r\n\r\n#Your line will look something like this:\r\n#Linux:\r\nsftpuser:x:1001:1001::\/home\/sftpuser:\/usr\/libexec\/openssh\/sftp-server\r\n\r\n#FreeBSD:\r\nsftpuser:x:$XX3edc8989Ra.:1001:1001::0:0:SFTP User:\/home\/sftpuser:\/usr\/libexec\/sftp-server\r\n\r\n#Type :wq to save and quit.\r\n<\/pre>\nYou may want to include the sftp command in your shell lists, i.e.,<\/p>\n
\r\nsudo nano \/etc\/shells\r\n\r\n#Include the following (Linux):\r\n\/usr\/libexec\/openssh\/sftp-server\r\n\r\n#Include the following (FreeBSD):\r\n\/usr\/libexec\/sftp-server\r\n<\/pre>\nThat’s it!<\/p>\n
–Derrick<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
I got an interesting question today. Our client needs to access to the server via SFTP, but they want to disable to the access to the SSH shell. Assuming that Continue Reading →<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[94,6],"tags":[158],"class_list":["post-3309","post","type-post","status-publish","format-standard","hentry","category-computer-problems-computer-help-pc-support","category-technology","tag-sftp"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/p1sqzr-Rn","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":1561,"url":"https:\/\/icesquare.com\/wordpress\/apache-wont-start-after-upgrading-to-2-2-21-in-freebsd-8-2\/","url_meta":{"origin":3309,"position":0},"title":"Apache won’t start after upgrading to 2.2.21 in FreeBSD 8.2","author":"Derrick","date":"September 15, 2011","format":false,"excerpt":"Apache 2.2.21 was rolled out today. Since it has some security fixes, I decide to put a new version on my server farm. I didn't know that it becomes a small headache today morning. The upgrade was running smooth, no error messages, no complaints, until I restart the Apache server\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"\/wordpress\/wp-content\/uploads\/2011\/09\/connectionReset.png","width":350,"height":200,"srcset":"\/wordpress\/wp-content\/uploads\/2011\/09\/connectionReset.png 1x, \/wordpress\/wp-content\/uploads\/2011\/09\/connectionReset.png 1.5x"},"classes":[]},{"id":1516,"url":"https:\/\/icesquare.com\/wordpress\/cups-client-1-4-8-is-marked-as-broken-gnutls-does-not-support-threads-yet-disable-the-gnutls\/","url_meta":{"origin":3309,"position":1},"title":"cups-client-1.4.8 is marked as broken: gnutls does not support threads yet; disable the GNUTLS.","author":"Derrick","date":"September 6, 2011","format":false,"excerpt":"I saw this message twice on two machines on two different days, end up using the same way to fix it. Case 1: Samba My Samba was down today, so I tried to start it manually: \/usr\/local\/etc\/rc.d\/samba start And I got the following error message: Removing stale Samba tdb files:\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2616,"url":"https:\/\/icesquare.com\/wordpress\/upgrade-freebsd-8-to-9\/","url_meta":{"origin":3309,"position":2},"title":"How to Upgrade FreeBSD from 8 to 9","author":"Derrick","date":"January 9, 2013","format":false,"excerpt":"Upgrading FreeBSD is very easy. Thanks for the simple architecture design and the disconnection between the kernel and the applications (ports), the whole process takes around 15 to 45 minutes. The coolest thing is that the system down time is very short. In my case, the down time was only\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1601,"url":"https:\/\/icesquare.com\/wordpress\/freebsd-startup-script-how-to-start-a-script-on-boot-in-freebsd\/","url_meta":{"origin":3309,"position":3},"title":"FreeBSD Startup Script – How to Start a Script on Boot in FreeBSD (An Alternative Solution to \/etc\/rc.local)","author":"Derrick","date":"September 22, 2011","format":false,"excerpt":"I want to start a script when booting my FreeBSD box automatically. Unlike Linux, FreeBSD does not honor the script you put in \/etc\/rc.local. Usually it is recommended to use the rc service (See here for details), however I think it is too complicated to convert my script to a\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1651,"url":"https:\/\/icesquare.com\/wordpress\/set-up-pure-ftpd-server-with-virtual-user-on-freebs\/","url_meta":{"origin":3309,"position":4},"title":"How to Set up a Pure-FTPd Server with Virtual User on FreeBSD","author":"Derrick","date":"October 11, 2011","format":false,"excerpt":"This tutorial is for FreeBSD. If you are looking for setting up Pure-FTPd on Linux, click here. My client likes to send me a huge data file (More than 10GB after compressed). Since I don't care about the security during the transfer, I decide to go with the old school\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"\/wordpress\/wp-content\/uploads\/2011\/10\/pure-ftpd.png","width":350,"height":200},"classes":[]},{"id":900,"url":"https:\/\/icesquare.com\/wordpress\/cannot-find-autoconf-please-check-your-autoconf-installation-and-the-php_autoconf-environment-variable-then-rerun-this-script\/","url_meta":{"origin":3309,"position":5},"title":"Cannot find autoconf. Please check your autoconf installation and the $PHP_AUTOCONF environment variable. Then, rerun this script.","author":"Derrick","date":"October 22, 2010","format":false,"excerpt":"This post is about FreeBSD, however the idea is about the same for other Unix systems. While I tried to install memcached, the system complained with this message: Cannot find autoconf. Please check your autoconf installation and the $PHP_AUTOCONF environment variable. Then, rerun this script. This problem is caused by\u2026","rel":"","context":"In "Computer Problems"","block_context":{"text":"Computer Problems","link":"https:\/\/icesquare.com\/wordpress\/category\/technology\/computer-problems-computer-help-pc-support\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts\/3309","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/comments?post=3309"}],"version-history":[{"count":9,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts\/3309\/revisions"}],"predecessor-version":[{"id":3650,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/posts\/3309\/revisions\/3650"}],"wp:attachment":[{"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/media?parent=3309"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/categories?post=3309"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/icesquare.com\/wordpress\/wp-json\/wp\/v2\/tags?post=3309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}