Few days ago, we taught you how to limit a user’s access to Linux system using Restricted shell. Once we have put the users in restricted mode, s/he can’t do anything, except what s/he was allowed to do. It will be helpful, if you want to allow a particular user to execute only a specific set of commands. In this guide, we are going to see how to allow or deny SSH access to a particular user or a group in Linux.
Allow Or Deny SSH Access To A Particular User Or Group In Linux
openSSH configuration file has two directives for both allowing and denying SSH access to a particular user(s) or a group.
Allow SSH Access to a user or group
First, we will see how to allow SSH access for a particular user, for example sk.
Please note that all commands should be run as root user.
Go to your remote server, and edit sshd_config file:
Add or edit the following line. Replace “sk” with your username.
You can also specify more than one user as shown below.
AllowUsers sk linuxmasterswiki
To allow an entire group, say for example root, add/edit the following line:
Those who are in the “root” group are can able to ssh to the remote server.
Save and quit the SSH config file. Restart SSH service to take effect the changes.
systemctl restart sshd
Now, the users sk, linuxmasterswiki or all the users under the group “root” are allowed to ssh into your remote server. The other users (except sk, linuxmasterswiki and users of “root” group) can’t ssh to the remote server.
If you try to ssh in to the remote server using any one of non-allowed user, you will get the following message:
Permission denied, please try again.
Now, let us go ahead and see how to deny/disable ssh access to a particular user or group.
Deny SSH Access to a user or group
To disable or deny SSH access to any user or group, you need to add/edit the following directives in your remote server’s sshd_config file.
To deny SSH access to specific user called “sk”, edit sshd_config file:
Add/edit the following line in sshd_config file.
Similarly, To deny SSH access to multiple users, specify the usernames with comma separated as shown below.
DenyUsers sk linuxmasterswiki
To deny SSH access to an entire group, add:
Save and quit the ssh config file. Restart ssh service to take effect the changes.
systemctl restart sshd
if you try to ssh to server using denied users, for example sk:
You will get the following message:
email@example.com's password: Permission denied, please try again. firstname.lastname@example.org's password:
More importantly you should disable Root user login too. Root ssh access is considered a bad practice in terms of security.
To disable root ssh login, edit sshd_config file:
Find the following line, Uncomment it, and set the value to no.
Restart SSH service. Congrats! You have just disabled the ssh root login.
Easy-peasy, right? That’s all for now. If you find this guide helpful, share it on your social networks and support Linux Masters Wiki.