Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Is it possible to deny access to a user (in my case www-data) from outside the network? Or possibly deny this:

ssh www-data@example.com

But allow this if already logged in:

su www-data
share|improve this question

1 Answer

up vote 6 down vote accepted

Excerpt from man sshd:

Regardless of the authentication type, the account is checked to ensure that it is accessible. An account is not accessible if it is locked, listed in DenyUsers or its group is listed in DenyGroups.

Run following command.

echo "DenyUsers www-data" >> /etc/ssh/sshd_config

then restart sshd

I would suggest specifying only certain users that are allowed to log into the machine via ssh using AllowUsers directive so that all other users are denied.

echo "AllowUsers valid_user1 valid_user2" >> /etc/ssh/sshd_config

share|improve this answer
K thanks. I'll try that. – Patrik Dec 9 '11 at 20:37
It seems to be working. The reson I asked this was because someone hacked me in some way and used the user www-data to run this commands: /usr/sbin/fakeproc. This took up 100% on one core. – Patrik Dec 9 '11 at 20:46
@Patrik sshd's restart must have ended that session. I suggest you allow ssh access to only valid users using AllowUsers directive. – Sachin Divekar Dec 9 '11 at 20:57
AllowGroups is another useful directive into that direction. @Sachin: A sshd restart will not terminate any running session. – Nils Dec 9 '11 at 22:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.