Comments on: OpenSSH deny or restrict access to users and groups http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html This is a Linux sys admin journal by Vivek about sys admin work, Linux tips & tricks, hacks, news and more. Fri, 10 Feb 2012 20:37:43 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Rashidhttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-171311 Rashid Sat, 14 May 2011 10:06:36 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-171311 thanks very helpful. i block icmp on my server through this. thanks thanks very helpful. i block icmp on my server through this.

thanks

]]> By: suzukihttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-159878 suzuki Sun, 26 Sep 2010 09:29:25 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-159878 I tried editing sshd_config with AllowUsers root. but all of users can ssh to configured host. I tried with DenyUsers too, but that is not working too. why? what i missed? thanks any help I tried editing sshd_config with AllowUsers root. but all of users can ssh to configured host. I tried with DenyUsers too, but that is not working too. why?
what i missed?

thanks any help

]]> By: DarkFaderhttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-158220 DarkFader Tue, 20 Jul 2010 23:18:21 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-158220 Match Address 127.0.0.1 PermitRootLogin without-password Yes, you can do that. It seems to work somewhat although it still asks for a password from elsewhere. Now I can have my "alias sshdo='ssh root@localhost'" combined with ssh-agent :) Match Address 127.0.0.1
PermitRootLogin without-password

Yes, you can do that. It seems to work somewhat although it still asks for a password from elsewhere.
Now I can have my “alias sshdo=’ssh root@localhost’” combined with ssh-agent :)

]]> By: Andreashttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-156759 Andreas Tue, 22 Jun 2010 09:27:32 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-156759 put into sshd_config following line, than you are able to root login with certs, but not with password: PermitRootLogin without-password put into sshd_config following line, than you are able to root login with certs, but not with password:

PermitRootLogin without-password

]]> By: sahabhttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-152620 sahab Wed, 30 Dec 2009 17:22:05 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-152620 Hi All How can I limit the user one time ssh login in freebsd 7.2, I have added below entry in @username - maxlogins 1 This method works with ubuntu linux. Not in Freebsd, Any idea for resolving Hi All
How can I limit the user one time ssh login in freebsd 7.2, I have added below entry in @username – maxlogins 1

This method works with ubuntu linux. Not in Freebsd,

Any idea for resolving

]]> By: milegrinhttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-151968 milegrin Tue, 01 Dec 2009 21:16:56 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-151968 sudo is already in place for standard OS & application admins. Direct root SSH is required for AIX's CSM or "Cluster Server Manager" which essentially allows me to run a command fromt eh CSM server on all servers or a specific server and I use it extensively for various reporting scripts, security and other functions but it requires root ssh. I have yet to find a decent working solution that does not rely on multiple instances or external dependencies (eg PAM) but I have it can be done however how is another animal completely. Thanx again for the advice sudo is already in place for standard OS & application admins. Direct root SSH is required for AIX’s CSM or “Cluster Server Manager” which essentially allows me to run a command fromt eh CSM server on all servers or a specific server and I use it extensively for various reporting scripts, security and other functions but it requires root ssh.

I have yet to find a decent working solution that does not rely on multiple instances or external dependencies (eg PAM) but I have it can be done however how is another animal completely.

Thanx again for the advice

]]> By: Daniel Reinhardthttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-151963 Daniel Reinhardt Tue, 01 Dec 2009 12:42:54 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-151963 For those of you who want to enable root access to multiple people then setup SUDO and give people sudo access via sudoers file. This way you can limit what each sudo user does. For those of you who want to enable root access to multiple people then setup SUDO and give people sudo access via sudoers file. This way you can limit what each sudo user does.

]]> By: LinuxLuserhttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-150379 LinuxLuser Thu, 27 Aug 2009 04:24:49 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-150379 eMBee / milegrin, Your best option may well just be a seperate sshd process that listens on a different port, that only allows root access. I would combine that with iptables (or other firewall) to only accept incoming connections to your second sshd port from your known/allowed hosts. Then, just update your automated scrips to connect to your non-standard port. Not too bad, considering that once you get it set up, it should run forever. Any localhost root users should be smart enough to accomodate the non-standart port assignment. Cheers, LinuxLuser eMBee / milegrin,

Your best option may well just be a seperate sshd process that listens on a different port, that only allows root access. I would combine that with iptables (or other firewall) to only accept incoming connections to your second sshd port from your known/allowed hosts. Then, just update your automated scrips to connect to your non-standard port. Not too bad, considering that once you get it set up, it should run forever. Any localhost root users should be smart enough to accomodate the non-standart port assignment.

Cheers,
LinuxLuser

]]> By: milegrinhttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-150120 milegrin Fri, 14 Aug 2009 08:34:59 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-150120 Hi Like eMBee, I am trying to deny root login from everywhere EXCEPT a specific host which is used to run automated remote tasks as root through ssh using keys. I have tried combinations AllowUser, DenyUsers to no avail. sshd_config takes preference over ssh_config so host definitions get overridden by the sshd_config entry "PermitRootLogin no" Using PAM restrictions is not really an option as this is an AIX box. Any idea as too how to achieve this would be greatly appreciated! - Michael Hi

Like eMBee, I am trying to deny root login from everywhere EXCEPT a specific host which is used to run automated remote tasks as root through ssh using keys.

I have tried combinations AllowUser, DenyUsers to no avail.
sshd_config takes preference over ssh_config so host definitions get overridden by the sshd_config entry “PermitRootLogin no”

Using PAM restrictions is not really an option as this is an AIX box.

Any idea as too how to achieve this would be greatly appreciated!
- Michael

]]> By: jose antoniohttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-145592 jose antonio Sun, 16 Nov 2008 00:05:31 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-145592 Thank you very much! Thank you very much!

]]> By: ramsamhttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-144378 ramsam Wed, 16 Jul 2008 16:45:50 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-144378 OS: uBuntu 7.10 I tried adding AllowUsers and restarting the sshd server but it still allows other users to ssh. It does not restrict users too... I even tried DenyUsers nothing works.... Need help. Thank you. Regards, Ram OS: uBuntu 7.10

I tried adding AllowUsers and restarting the sshd server but it still allows other users to ssh.
It does not restrict users too… I even tried DenyUsers nothing works…. Need help.

Thank you.
Regards,
Ram

]]> By: sobashttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-141124 sobas Mon, 17 Sep 2007 07:23:59 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-141124 /etc/ssh/sshd_config PermitRootLogon no Above denies root to login remotely but is able to login locally on the console. Use sudo to give access to sys admins. /etc/ssh/sshd_config
PermitRootLogon no

Above denies root to login remotely but is able to login locally on the console.

Use sudo to give access to sys admins.

]]> By: stevehttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-140538 steve Fri, 20 Jul 2007 06:42:49 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-140538 Dear all, how can i restrict a user to view others folder except his own folder after login? thanks steve Dear all,

how can i restrict a user to view others folder except his own folder after login?

thanks

steve

]]> By: eMBeehttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-4016 eMBee Thu, 03 Aug 2006 00:03:48 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-4016 LinuxTitli: using the users password for root access is not really good either. if some users account is compromized (because someone managed to get at the users password), then root is automaticly compromized as well. i look forward to try the suggestions in nixcrafts new article soon. LinuxTitli: using the users password for root access is not really good either. if some users account is compromized (because someone managed to get at the users password), then root is automaticly compromized as well.

i look forward to try the suggestions in nixcrafts new article soon.

]]> By: eMBeehttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-4014 eMBee Wed, 02 Aug 2006 23:48:47 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-4014 i did a few quick tests on the interaction of AllowUsers and AllowGroups and it seems that they can't really be used together. when i set: AllowUsers: root@localhost AllowGroups: users the result was that noone could login, even adding root to the group users didn't help. i did a few quick tests on the interaction of AllowUsers and AllowGroups and it seems that they can’t really be used together. when i set:

AllowUsers: root@localhost
AllowGroups: users

the result was that noone could login, even adding root to the group users didn’t help.

]]> By: nixcrafthttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-3993 nixcraft Wed, 02 Aug 2006 15:04:43 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-3993 You need to configure PAM login access control tables. These tables will give you desired effect i.e. allow any users except root from anywhere, and root only from localhost (just like iptables). There is also a iptables module which attempts to match various characteristics of the packet creator (both INPUT and OUTPUT chain) but it is badly broken and it may not work on SMP system at all. I will post more info about login access control tables soon. See URL: http://www.cyberciti.biz/tips/openssh-root-user-account-restriction-revisited.html You need to configure PAM login access control tables. These tables will give you desired effect i.e. allow any users except root from anywhere, and root only from localhost (just like iptables).

There is also a iptables module which attempts to match various characteristics of the packet creator (both INPUT and OUTPUT chain) but it is badly broken and it may not work on SMP system at all.

I will post more info about login access control tables soon. See URL: http://www.cyberciti.biz/tips/openssh-root-user-account-restriction-revisited.html

]]> By: LinuxTitlihttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-3992 LinuxTitli Wed, 02 Aug 2006 14:58:54 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-3992 Planet Malaysia, follow emBee\'s suggestion or add user to group grant necessary file level permissions Planet Malaysia, follow emBee\’s suggestion or add user to group grant necessary file level permissions

]]> By: LinuxTitlihttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-3991 LinuxTitli Wed, 02 Aug 2006 14:56:22 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-3991 Hmm... Have you evaluated or considered sudo option? I use sudo extensively here. Although it is not 100% perfect but better than sharing root password. It also log down all failed (or command access) messages. Sudo is your best option, IMPO. Let me know if you are aware of any other tools or methods.... Hmm…

Have you evaluated or considered sudo option? I use sudo extensively here. Although it is not 100% perfect but better than sharing root password. It also log down all failed (or command access) messages. Sudo is your best option, IMPO.

Let me know if you are aware of any other tools or methods….

]]> By: eMBeehttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-3988 eMBee Wed, 02 Aug 2006 13:38:57 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-3988 Planet Malaysia: for rsync you would want to allow root specificly for the host that you are synchronizing with. Planet Malaysia: for rsync you would want to allow root specificly for the host that you are synchronizing with.

]]> By: eMBeehttp://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-3987 eMBee Wed, 02 Aug 2006 13:36:26 +0000 http://www.cyberciti.biz/tips/openssh-deny-or-restrict-access-to-users-and-groups.html#comment-3987 using su forces the use of a shared password, which is what i want to avoid. AllowUsers says in the documentation: "If specified, login is allowed only for user names that match one of the patterns." that means ALL OTHER users will be blocked, which is not desired either. i need something that allows me to say: allow any users except root from anywhere, and root only from localhost. there may be a way to combine AllowUsers and AllowGroups, but the docs say nothing about how those two would interact. using su forces the use of a shared password, which is what i want to avoid.

AllowUsers says in the documentation:
“If specified, login is allowed only for user names that match one of the patterns.”

that means ALL OTHER users will be blocked, which is not desired either. i need something that allows me to say: allow any users except root from anywhere, and root only from localhost.

there may be a way to combine AllowUsers and AllowGroups, but the docs say nothing about how those two would interact.

]]>