Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to forbid ssh access (except localhost) for specified user.

So. ssh localhost should work. ssh hostname from outside should not work for that user.

All other users should work as usual.

share|improve this question
By the way, is this user root? – Pedro Romano Oct 30 '12 at 15:11
@PedroRomano, no, it is not. – denys Oct 30 '12 at 15:29

See the AllowUsers and DenyUsers directives of the sshd_config man page (and possibly also AllowGroups and DenyGroups).

Basically these directives take a list of user patterns in the user@host format separated by spaces. Directives have the following precedence: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

For the simple case of just allowing a specific user from localhost, only the following line should be added:

AllowUsers user@localhost

This will implicitly deny any user from anywhere that isn't user@localhost.

share|improve this answer
Thanks @PedroRomano So. As I have understood the manual I should add next lines to /etc/ssh/sshd_config: DenyUsers user@* and AllowUsers user@localhost. Right? – denys Oct 30 '12 at 14:13
no. my try is wrong... – denys Oct 30 '12 at 14:29
No. Just add AllowUsers user@localhost. DenyUser user@* takes precedence over AllowUsers and will deny user from everywhere. By setting AllowUsers user@localhost you are only allowing that user from that host explicitly and denying everyone else from everywhere else implicitly. – Pedro Romano Oct 30 '12 at 14:34
yes, but this line affects also other users. All other users are denied. I do not want to touch other users.... – denys Oct 30 '12 at 14:54
What you need is unfortunately not trivial to achieve because of Deny always taking precedence over Allow. Can you create a group with all other users and add an AllowGroup group@* directive for that group? – Pedro Romano Oct 30 '12 at 15:01

How about if you force public key authentication for the specific user, and then restrict his public key with a from= option in the authorized keys file.

To force a specific user to use public key authentication:

Match User Bad_User
    PasswordAuthentication no
    AuthorizedKeysFile /somewhere/the/user/cannot/touch

And then in the authorized keys file configure his key like this:

from=localhost ssh-rsa AAAA...

You can read more about Match directives in man sshd_config, and about authorized keys options in man sshd.

share|improve this answer
The downside is that as long as the user can login, they can also change their authorized_keys file. – Jenny D Jan 21 '14 at 8:10

You could use PAM (UsePAM in sshd_config) and add

account  required     pam_access.so

to the PAM configuration for ssh.

Then you can define access policies in /etc/security/access.conf

+ : john : ::1
- : john : ALL
+ : ALL : ALL


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.