Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I modify my sshd_config so that it blocks access to all users except the root user?

I've had a look and I tried

AllowUsers root
DenyUsers *

But that doesn't do anything

share|improve this question
I'm curios why you want that, normally (and by default in many distributions) it is exactly the other way round for security reasons. – Bobby Oct 14 '12 at 18:49
I use keyfile instead of passwords but the goal of this isn't to hide the root account its to reduce the complexity of monitoring – Akshat Oct 14 '12 at 22:01
up vote 5 down vote accepted

I tried this myself, adding only the AllowUsers root line, which worked without a hitch. Probably an obvious question, but since you didn't mention it explicitly: did you restart the sshd service after making the modification?

share|improve this answer

If you're using Linux, you can use the pam_succeed_if.so PAM module (if your distro has it). Other OSes may or may not have it so YMMV.

in /etc/pam.d/sshd:

account    sufficient   pam_succeed_if.so login = <username>

You can also allow specific groups, or numerical uids/gids, etc.

See http://linux.die.net/man/8/pam_succeed_if for more information on this PAM Module.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.