From owner-freebsd-questions@FreeBSD.ORG Tue Dec 14 16:23:57 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3940F16A4CE for ; Tue, 14 Dec 2004 16:23:57 +0000 (GMT) Received: from out009.verizon.net (out009pub.verizon.net [206.46.170.131]) by mx1.FreeBSD.org (Postfix) with ESMTP id AE04843D62 for ; Tue, 14 Dec 2004 16:23:56 +0000 (GMT) (envelope-from leblanc@keyslapper.org) Received: from keyslapper.org ([68.163.245.18]) by out009.verizon.net (InterMail vM.5.01.06.06 201-253-122-130-106-20030910) with ESMTP id <20041214162356.UWED24088.out009.verizon.net@keyslapper.org> for ; Tue, 14 Dec 2004 10:23:56 -0600 Received: by keyslapper.org (Postfix, from userid 1001) id 1E3FC1158E; Tue, 14 Dec 2004 11:23:54 -0500 (EST) Date: Tue, 14 Dec 2004 11:23:54 -0500 From: Louis LeBlanc To: questions@freebsd.org Message-ID: <20041214162353.GA20997@keyslapper.org> Mail-Followup-To: questions@freebsd.org References: <200412141011.23225.josh@tcbug.org> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <200412141011.23225.josh@tcbug.org> User-Agent: Mutt/1.5.6i X-Authentication-Info: Submitted using SMTP AUTH at out009.verizon.net from [68.163.245.18] at Tue, 14 Dec 2004 10:23:55 -0600 Subject: Re: sftp and shell access X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: freebsd-questions@FreeBSD.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Dec 2004 16:23:57 -0000 On 12/14/04 10:11 AM, Josh Paetzel sat at the `puter and typed: > I am looking for a way to give a user an sftp account without giving > them a shell. So far I've tried setting their shell > to /sbin/nologin, but when they try to log in via sftp it gives them > a "message to long" error. > > Any pointers would be appreciated...I've tried the FAQ, handbook and > google so far. Can you restrict external logins from /etc/login.access? You can do it by username or group, ie. ftponly. This should do it: # Disallow logins to all in the ftponly group -:ftponly:ALL This should only affect shell logins, so ftp should still work. -- Louis LeBlanc FreeBSD@keyslapper.org Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://www.keyslapper.org ԿԬ Correspondence Corollary: An experiment may be considered a success if no more than half your data must be discarded to obtain correspondence with your theory.