Do you need a shell for SCP?

Question

I'm allowing a friend a local account on my machine, exclusively for SCP. Can I specify his account's shell as /bin/true, or in any other way limit the account, while still allowing SCP?

Gilles 'SO- stop being evil' · Accepted Answer · 2023-09-28T07:47:21.757

45

I recommend using rsync instead of scp. For users, it has many more useful features. On the server side, it comes with rrsync to allow synvc access inside a given directory, but no general shell access and no access to other directories.

Alternatively, you can restrict the account to only allow SFTP and not shell access. SFTP is a distinct access type in the SSH protocol, unlike rsync and scp which work by running a shell command on the server. (rrsync restricts access by only allowing one specific shell command, which only supports certain rsync transfers and nothing else.) SFTP access enables SFTP clients as well as SSHFS.

Historically, there were projects such as rssh and scponly, which you could set as user's shell, and then the user would only be able to run file copies and not get shell access. However, those projects are unmaintained and very likely insecure by now.

edited Sep 28 '23 at 07:47

answered Mar 21 '11 at 22:10

Gilles 'SO- stop being evil'

829,060

So does this mean /bin/false or /bin/true wouldn't work - or only allow sftp? – Danny Staple Sep 08 '11 at 15:40
3

@DannyStaple If a user's shell is set to /bin/false or other program that does nothing, neither scp nor sftp will work. For both commands, the SSH daemon fires off a shell command that runs a dedicated server process (scp -f or sftp-server). It needs a Bourne-style shell, or at least a close enough approximation (such as rssh which allows only these few commands through). – Gilles 'SO- stop being evil' Sep 08 '11 at 20:00
1

rssh no longer exists, they've pulled the code because they consider it unsafe to use. scponly hasn't been updated in a decade. Not looking promising anymore. – anthonyryan1 Sep 27 '23 at 18:33

score 3 · Answer 2 · edited Apr 13 '17 at 12:36

3

No, you don't. As Gilles pointed out, rssh works very nicely to this end, as does scponly. See also the discussion in this related question.

edited Apr 13 '17 at 12:36

Community

1

answered Mar 22 '11 at 07:54

Shadur-don't-feed-the-AI

31,260

2

They're still shells, as pointed out /bin/false will not work, neither will chmod 644 ksh. – Steve-o Sep 09 '11 at 07:55

Do you need a shell for SCP?

2 Answers2

Linked