Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite

How can I modify my sshd_config so that it blocks access to all users except the root user?

I've had a look and I tried 

AllowUsers root
DenyUsers *

But that doesn't do anything

share|improve this question
2  
I'm curios why you want that, normally (and by default in many distributions) it is exactly the other way round for security reasons. – Bobby Oct 14 '12 at 18:49
I use keyfile instead of passwords but the goal of this isn't to hide the root account its to reduce the complexity of monitoring – Akshat Oct 14 '12 at 22:01

2 Answers

up vote 4 down vote accepted

I tried this myself, adding only the AllowUsers root line, which worked without a hitch. Probably an obvious question, but since you didn't mention it explicitly: did you restart the sshd service after making the modification?

share|improve this answer
up vote 1 down vote

If you're using Linux, you can use the pam_succeed_if.so PAM module (if your distro has it). Other OSes may or may not have it so YMMV.

in /etc/pam.d/sshd:

account    sufficient   pam_succeed_if.so login = <username>

You can also allow specific groups, or numerical uids/gids, etc.

See http://linux.die.net/man/8/pam_succeed_if for more information on this PAM Module.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.