3

Other people log into my Raspberry Pi via SSH. It runs Ubuntu Mate 16.04 with OpenSSH. I want to disable some of the accounts but not delete them.

Now, I could just delete the passwords (which obviously has the disadvantage that a way to set the password, again, has to be found, unless I manually change the contents of the shadowfile which feels like a really bad idea) of the accounts I want to disable and rename their ~/.ssh/authorized_keys files to prevent them from logging in. However, I'd like there to be an error message on their consoles when they attempt to log in, describing why I disabled their accounts. The message is the same for all disabled accounts.

There seems to be an easy way to disable SSH login for entire groups which means that I can just add the users I want to disable to a certain group and disable SSH login for that group. However, this doesn't print them the message I want to be shown on their consoles.

I know how to put a message on the user's console once they logged in. But the goal, here, of course is that they don't get that far.

Because the users don't have physical access to my Raspberry Pi, I don't care whether the accounts are entirely disabled or it's just not possible to log into them via SSH. I don't care about the user switching to a different account via su later on because only root and my user account can do this, anyways.

2

Well ... one of all the possible answers is to change the shell of the user to /sbin/nologin. It will allow to authenticate and then say

This account is currently not available.

(if the /sbin/nologin is in /etc/shells)

Otherwise you can use similar approach as the linked article with ForceCommand:

Match Group disabled_group # or User disabled_user
  ForceCommand echo "This account is disabled"
  • I suppose both methods will also disable access via SFTP or accessing a git repo via SSH but only the first one will disable logging into the machine (terminal, graphically) if you have physical access to it. Is this correct? – UTF-8 Dec 2 '16 at 16:06
  • yes, you are right. – Jakuje Dec 3 '16 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.