Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

My Linux has many not-human users like cron, ntp, daemon, http, etc. I want to disable anybody to login as any of this users. Real people on my machine are root and me, so only root and me should be able to login.

For not-human users in the /etc/passwd file /bin/false defined as shell, but I have read it doesn't protect for login via SSH, for example.

passwd -l doesn't protect for login via SSH too (as the man says).

Is there solution at all?

share|improve this question
1  
/bin/false should protect, if you use "use-login" in sshd_config. –  Nils Oct 27 '12 at 20:00
add comment

2 Answers

up vote 3 down vote accepted

System accounts should already be locked, by setting their password hash to an invalid one (I see x and ! in my /etc/shadow). The only ways to get into their accounts without a password (as far as I know) are ssh with keypair auth (impossible unless someone with write permissions in their home directory put a public key in their ~/.ssh/authorized_keys), you can use Alex's AllowUsers configuration to prevent that remote possibility; and using su as root to get a shell as them. This possibility is impossible to prevent if anyone has access to root power. But if they do have root permissions, suing to a daemon account is the last thing you need to worry about.

share|improve this answer
add comment

Edit /etc/ssh/sshd_config as root. Locate the AllowUsers option and change it to just your username.

Do not allow root to login over SSH.

share|improve this answer
    
I'm some confused why this is SSH setting. Is there system way to force disable login (by any method: getty, ssh, telnet...) for an user? –  Corvus Oct 27 '12 at 20:05
    
Why should root login be disabled over SSH? –  heinrich5991 Oct 28 '12 at 0:33
    
It is recommended to login as a non-privileged user and use sudo, if root account is shared between several people. This way accountability is preserved - who did what. –  Vitaly Osipov Oct 28 '12 at 22:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.