How can I permit only certain users to ssh?

Question

In a system where all personnel have ssh connectivity, is it safe to use AllowUsers $USER in /etc/ssh/sshd_config?

I want all the personnel to have ssh access, but I don't want system accounts to have ssh permissions. I would also like to set that up with out having to perpetually add users to the config file. Is there a variable I could use instead? If I assume username == user home, then maybe AllowUsers ls /home/ would work. I'm not sure if I should do that.

Answer 1

Do the opposite. Use DenyUsers in sshd_config to prevent logins by the users in the list.

The list of users you would deny login capabilities will generally be the superuser and any users who have /bin/nologin as their shell. In addition examine your /etc/passwd file and determine any user who's installed as part of a package. On CentOS 7, those users will generally have uids less than 1000.

Here's mine on CentOS 7:

DenyUsers root bin daemon adm lp sync shutdown halt mail operator games ftp nobody dbus polkitd tss colord usbmuxd rpc rtkit qemu radvd ntp chrony abrt avahi-autoipd unbound rpcuser nfsnobody libstoragemgmt saslauth pulse gdm gnome-initial-setup avahi pcp postfix sshd oprofile tcpdump lightdm openvpn nm-openconnect

I got that list by running an awk script I call "denyusers.awk":

./denyusers.awk /etc/passwd

Here's the source for my "denyusers.awk" script.

#!/bin/awk -f
BEGIN {
    FS=":";
    printf("%s","DenyUser root");
}

{
    username=$1;
    uid=$3
    shell=$7;
    if ((uid<1000) || ( shell == "/sbin/nologin" )) {
       printf(" %s", username);
    }
}

END {
    print "";
}