I have a sftp server running on RedHat AS3 server and there is a user account aaa. What I want to do is to deny sftp access and allow ssh access to the particular user (aaa)

Can someone point me in the right direction.]

Regards

To give a user ssh access to your server, create an account for them and make sure the ssh server is running and they have an ssh client.

To refuse ftp access, don't allow anonymous logins and blacklist the user (or run a whitelist).

Hi thanks but thing is every who has a account can access sftp and ssh. I want a particular user account (lets say aaa account)must be able to ssh but deny if that account tries to sftp

Regards

Read the following:
http://www.debian-administration.org/articles/94
... usually you want to allow file access but not running commands. You seem to want the opposite. This seem a little self defeating as what is stopping a user running sftp from an ssh shell... or just cding into the file directory and using scp?

I thought you didn't want remote users gaining sftp access to your machine... now it seems you don't want local users to be able to use an ftp client from your machine. Which is it?

Hi

I am sorry about the confusion let me explain the situation.

I have some java programs and these are executed by normal user. Lets say the user account is AAA then this AAA account should be able execute these java programs but not copy these files in any means.

1. This user AAA should be able to ssh to the server from remote machine and just execute the programs
2. This user AAA should be forbidden to sftp to sever from a remote machine.

Only this particular user AAA should be denied of sftp and allowed ssh to execuit the java programs rest of the users should be as default

Thanks

Best regards

Well.. don't serve the files in your ftp server. (you are not allowing remote users complete access right?)

Your remaining trouble will involve scp.

Why not keep the files in a location the user does not have access to, i.e. not in that users account, and have them use a script to execute the file? They can copy the script, but that doesn't do them any good.

Another issue is why you care that this user can copy your java files.

If there is only one java program that is run, then you could look at having a per-user config entry ( using a "Match" segment ) in sshd_config that will run the java program after the user is authenticated ( "ForceCommand" option).