<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=Content-Type content="text/html; charset=us-ascii"> <META content="MSHTML 6.00.2800.1264" name=GENERATOR></HEAD> <BODY> <DIV><SPAN class=454154719-02032004><FONT face=Verdana size=1>Hello,</FONT></SPAN></DIV> <DIV><SPAN class=454154719-02032004><FONT face=Verdana size=1></FONT></SPAN> </DIV> <DIV><SPAN class=454154719-02032004><FONT face=Verdana size=1>Does anyone know how one might disallow a user to logon to a secure shell but still allow them to make a secure login for ftp (sftp)? I want this person to have ftp access but not, specifically, have the ability to run passwd. I tried changing their shell to a variety of bogus filenames (/dev/null, /bin/ftponly, both as an empty file and as a symlink to /dev/null), and discovered at that point that sftp must allow an ssh login to work. I can't block in hosts.deny or allow because this user obtains an ip from the same dhcp pool we all do; denying by ip is no good.</FONT></SPAN></DIV> <DIV><SPAN class=454154719-02032004><FONT face=Verdana size=1></FONT></SPAN> </DIV> <DIV><SPAN class=454154719-02032004><FONT face=Verdana size=1>Any ideas?</FONT></SPAN></DIV> <DIV><SPAN class=454154719-02032004><FONT face=Verdana size=1></FONT></SPAN> </DIV> <DIV><SPAN class=454154719-02032004><FONT face=Verdana size=1>Thanks,</FONT></SPAN></DIV> <DIV><SPAN class=454154719-02032004><FONT face=Verdana size=1></FONT></SPAN> </DIV> <DIV><SPAN class=454154719-02032004><FONT face=Verdana size=1>Michael Salmons</FONT></SPAN></DIV> <DIV><SPAN class=454154719-02032004><FONT face=Verdana size=1><A href="mailto:salmonsm@missouri.edu">salmonsm@missouri.edu</A></FONT></SPAN></DIV></BODY></HTML>