scp/sftp but not SSH

[dev44]

Hi,

Does anyone know of a way to allow root scp/sftp but not allow root to login with SSH. If I disallow root login in the sshd_config that disables it for scp and sftp as well. We don't want people logging in as root but should "su" to root. However, very often we have to move files and their contents around for users and not having the root access for that is very inconvenient.

I doubt there is a way, but figured I would put this out there because if there is a way, I would find it here.

[TTr]

ssh has a similar mechanism to that of /usr/bin/false. You can use the /opt/ssh/libexec/sftp-server as the shell in /etc/passwd, then this account is limited to sftp only.
Of course you don't want to change the root's shell but if you create a different account with root privilidges you can use this account for sftp only. I have not tried it so you 'll need to test it out.

[Heironimus]

You can destroy a system just as effectively with scp and sftp as you can with an interactive shell. You either allow direct root logins or you don't, there are very few levels in between that really make sense.

[dev44]

This isn't just for one or two users, it is a global thing we want to do.

[TTr]

Your original question was about root.

> to allow root scp/sftp but not allow root to login

Now you are asking

> This isn't just for one or two users, it is a global thing we want to do.

What am I missing?