I have an array of users who need to just upload files to their set homedirs. I think sftp would suffice, but I don't want them to login via shell. So is it possible?
My platform is centos 7, user's homedirs are stored lets say /personal/$user

I created user with these settings

useradd -m -d /personal/user1 -s /sbin/nologin

assigned user a passwd, then when I use sftp to login to the machine, it says cannot connect.

I like the following setup for managing SSH access, which I use at work to manage a group of users on small fleet of servers.

Its key feature is managing SSH rights through Unix group membership, and having pretty tight permissions by default.

Setting up

Install software (optional but useful):

yum install members   # or apt install members

Add groups:

addgroup --system allowssh

addgroup --system sftponly

In /etc/ssh/sshd_config, ensure that the following to settings are No:

PermitRootLogin no

PubkeyAuthentication no

PasswordAuthentication no

And at the end of /etc/ssh/sshd_config, add these two stanzas:

Match Group allowssh

    PubkeyAuthentication yes



Match Group sftponly

    ChrootDirectory %h

    X11Forwarding no

    AllowTcpForwarding no

    ForceCommand internal-sftp

(don't forget to restart SSH after editing the file)

Explanation

So, what does all this do?

• It always disables root logins, as an extra security measure.


• It always disables password-based logins (easily the biggest security issue with SSH).


• It only allows pubkey login for users in the allowssh group.


• Users in the sftponly group cannot get a shell over SSH, only SFTP.

Managing who has access is then simply done by managing group membership (these changes take effect immediately, no SSH restart required):

# adduser marcelm allowssh

# members allowssh

marcelm

# deluser marcelm allowssh

# members allowssh

#

Note that your sftp users need to be members of both sftponly (to ensure they won't get a shell), and of allowssh (to allow login in the first place).

Note also that you need to use public key authentication; password logins no longer work. This is probably the single biggest security gain you can get with SSH, so it's worth the effort.

Extra information

You can set the shell of the sftponly users to /sbin/nologin if you want, according to your own tastes.

This configuration limits sftponly users to their homedirectory. If you do not want that, remove the ChrootDirectory %h directive.

For bonus points, have a look at restricting who can su to root; add a system group called wheel, and add/enable auth required pam_wheel.so in /etc/pam.d/su.

Edit your /etc/ssh/sshd_config to contain:

Match User [SFTP user]

ForceCommand internal-sftp

Restart sshd. If you have multiple users put them all on the match user line separated by commas like so:

Match User User1,User2,User3

The key to configuring sftp to not allow shell access is to limit users via the ForceCommand option.

just change their default shell to /sbin/nologin. Assuming most varieties of Linux:

# usermod -s /sbin/nologin username