Set up sftp to use password but ssh not to use password
As I understand you have (at least for this particular problem) two distinct groups of users, one being able to login via SSH and get an interactive shell (let's call the group ssh
) and one being able to login via SFTP and only get an SFTP shell (let's call the group sftp
).
Now create the groups ssh
and sftp
on your system with groupadd
, put the respective users in the groups (gpasswd -a $USERNAME $GROUPNAME
) and append the following lines at the end (this is important!) of your sshd_config
located at /etc/ssh/sshd_config
:
Match Group sftp
PasswordAuthentication yes
# Further directives for users in the "sftp" group
Match Group ssh
PasswordAuthentication no
# Further directives for users in the "ssh" group
Read about the Match
directive in sshd_config(5) and about the allowed patterns in ssh_config(5).
You'll also have to restart the ssh
process for this to take effect:
sudo /etc/init.d/ssh restart