Question: Is it possible to disable direct login for normal users (like `oracle`) in Linux but allow `scp` and `sftp` for that use?

Answer: 
Methods such as creating the file `/etc/nologin`, setting account login shells to `/bin/false` or `/sbin/nologin` effectively disable user accounts from logging into an interactive shell, but do not protect the system.

If you want to specifically restrict a user to using `scp` or `sftp` only, install a restricted shell that is designed to do exactly that. The `rssh` package is a restricted shell designed to work with OpenSSH. 

```
: rssh is a restricted shell for use with OpenSSH, allowing only scp
: and/or sftp. For example, if you have a server which you only want
: to allow users to copy files off of via scp, without providing shell
: access, you can use rssh to do that. It is a alternative to scponly.

```

You should seriously consider setting a `chroot` for the users logging in with the restricted `rssh` shell. 

Read and understand the security implications of restricting users in such a way. Start with the `man` pages for `rssh` and `rssh.conf`. You should also understand what a `chroot` [is and how it works](https://unix.stackexchange.com/questions/105/chroot-jail-what-is-it-and-how-do-i-use-it).
You can Add this to sshd\_config:

```
Match User oracle
        ForceCommand set - ""$SSH_ORIGINAL_COMMAND; [ "$1" = "scp" ] || exit 1; CMD=`IFS='\`&;<>'; set - ""$SSH_ORIGINAL_COMMAND; echo $1`; [ "$CMD" ] || exit 1; exec $CMD

```

Here, I'm matching the user 'oracle'. Instead you can use `Match group scponly` to match users within the 'scponly' group. If anyone tries to connect in a way that doesn't run scp, then it will silently exit with return code 1.

If the account uses key-based authentication, you can prepend the key in the user's .ssh/authorized\_keys file with `command="<above commands>"`.

While I've added some safety against manipulating the file to cause a rogue command to be executed (by truncating at any `&``;<>` characters), I can't be sure that this can't be worked around some way I haven't thought of.

This is all a bit long and messy to stick into an sshd\_config file, and a typo could break stuff for other users. It might be better to create a script that does the checking for "scp", and then just call that script from the ForceCommand, thus making the mods in `sshd_config` much simpler. Check out <https://serverfault.com/questions/749474/ssh-authorized-keys-command-option-multiple-commands> for some examples of this.