Sftp-Only User Accounts

Setting up users with very limited access to systems -- nothing more than they need, used to be a little tricky. You could create a specialized environment, chain the visitor to his home directory and do a lot of testing to be sure that your limits were strictly enforced. Limiting a user to only being able to move files to and from your system with sftp is surprisingly simple.

The first thing you need to do is find the sftp-server executable on your system. Let's say the file is /usr/local/libexec/sftp-server. Next, create your new user's account using this file as the user's shell:

# grep sftponly /etc/passwd
sftponly:x:9042:8080:sftp-only:/home/sftponly:/usr/local/libexec/sftp-server

If this is the first user to be set up with access limited to sftp, you will also need to add your sftp-server executable to the list of valid shells. You can easily add the file to the /etc/shells file like this:

echo "/usr/local/libexec/sftp-server" >> /etc/shells

At this point, you can test the account using sftp.

# sftp visitor@localhost
Connecting to localhost...
visitor@localhost's password:
sftp> ls
sftp> put test
Uploading test to /home/visitor/test
test                                          100%  415     0.4KB/s   00:00
sftp> ls
test
sftp> bye

Anyone used to ftp should have no trouble using sftp. The security advantages are considerable. All data passing back and forth between the server and the sftp client are encrypted.

If your new user is uploading and downloading files from his Windows, Linux or Mac OS X desktop and wants a nicer interface for uploading and downloading files, introduce him to FileZilla. To use sftp with FileZilla, all he has to do is put "22" into the Port: field in the window's header or "sftp://" ahead of the server's name in the Host: field.

This setup provides sftp-only access, but does not restrict these users to their home directories, so don't count on this as a solution for managing untrusted visitors. If you need to restrict your new user to his home directory as well as to only using sftp, you will need a modified sftp-server that adds a chroot function.