In a system where all personnel have ssh connectivity, is it safe to use AllowUsers $USER in /etc/ssh/sshd_config?

I want all the personnel to have ssh access, but I don't want system accounts to have ssh permissions. I would also like to set that up with out having to perpetually add users to the config file. Is there a variable I could use instead? If I assume username == user home, then maybe AllowUsers ls /home/ would work. I'm not sure if I should do that.

  • 5
    Use AllowGroups, put actual humans in a group for humans.
    – DopeGhoti
    Dec 2, 2016 at 21:30
  • 1
    As DopeGhosti suggested, AllowGroups and put the (many?) humans in a group. Or use DenyGroups to put the (fewer?) system accounts in a group.
    – steve
    Dec 2, 2016 at 21:35

1 Answer 1


Do the opposite. Use DenyUsers in sshd_config to prevent logins by the users in the list.

The list of users you would deny login capabilities will generally be the superuser and any users who have /bin/nologin as their shell. In addition examine your /etc/passwd file and determine any user who's installed as part of a package. On CentOS 7, those users will generally have uids less than 1000.

Here's mine on CentOS 7:

DenyUsers root bin daemon adm lp sync shutdown halt mail operator games ftp nobody dbus polkitd tss colord usbmuxd rpc rtkit qemu radvd ntp chrony abrt avahi-autoipd unbound rpcuser nfsnobody libstoragemgmt saslauth pulse gdm gnome-initial-setup avahi pcp postfix sshd oprofile tcpdump lightdm openvpn nm-openconnect

I got that list by running an awk script I call "denyusers.awk":

./denyusers.awk /etc/passwd

Here's the source for my "denyusers.awk" script.

#!/bin/awk -f
    printf("%s","DenyUser root");

    if ((uid<1000) || ( shell == "/sbin/nologin" )) {
       printf(" %s", username);

    print "";

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .