Question: Is it possible to disable direct login for normal users (like `oracle`) in Linux but allow `scp` and `sftp` for that use?

Answer: 
You can Add this to sshd\_config:

```
Match User oracle
        ForceCommand set - ""$SSH_ORIGINAL_COMMAND; [ "$1" = "scp" ] || exit 1; CMD=`IFS='\`&;<>'; set - ""$SSH_ORIGINAL_COMMAND; echo $1`; [ "$CMD" ] || exit 1; exec $CMD

```

Here, I'm matching the user 'oracle'. Instead you can use `Match group scponly` to match users within the 'scponly' group. If anyone tries to connect in a way that doesn't run scp, then it will silently exit with return code 1.

If the account uses key-based authentication, you can prepend the key in the user's .ssh/authorized\_keys file with `command="<above commands>"`.

While I've added some safety against manipulating the file to cause a rogue command to be executed (by truncating at any `&``;<>` characters), I can't be sure that this can't be worked around some way I haven't thought of.

This is all a bit long and messy to stick into an sshd\_config file, and a typo could break stuff for other users. It might be better to create a script that does the checking for "scp", and then just call that script from the ForceCommand, thus making the mods in `sshd_config` much simpler. Check out <https://serverfault.com/questions/749474/ssh-authorized-keys-command-option-multiple-commands> for some examples of this.
The login shell can be changed from `bash` to `/usr/sbin/nologin` or `/bin/false` do prevent a normal login. The login shell can be changed with `usermod`:

```
usermod user_name -s /usr/sbin/nologin

```