0

There are 2 users: root seconduser

I needed to change passwords for both of them and so I did. After that I would receive an access denied error when logging in as seconduser. However, I could still login as root user with the new password.

In order to allow the seconduser, I have edited etc/ssh/sshd_config by adding the following at the bottom of the document:

AllowUsers seconduser

Restarted sshd after that and logged out of root to try and login as seconduser. This, did not work (same error: access denied), but now I get the same for root user as well. I am basically left out without any access to the server.

How can access be regained? Server is running CentOS 6.8.

Any help is much appreciated.

  • Check the log file on the server, usually /var/log/auth.log to see why your regular user gets access denied. Add the error message to your question and you might get useful advice. – Shadur Jan 12 '17 at 12:53
  • Can I get to this file without logging in? – Domas Jan 12 '17 at 12:56
  • Well, you can't because you locked yourself out. – Shadur Jan 12 '17 at 12:58
  • So how can the access be regained? – Domas Jan 12 '17 at 13:00
  • 1
    Writing an answer, gimme a minute. Short version: Physical access. – Shadur Jan 12 '17 at 13:00
6

Short answer: You screwed yourself over and are going to have to physically access the machine to unscrew it.

Long answer: You misunderstood the meaning and syntax of the AllowUsers directive.

From the manpage:

 AllowUsers
         This keyword can be followed by a list of user name patterns,
         separated by spaces.  If specified, login is allowed only for
         user names that match one of the patterns.  Only user names are
         valid; a numerical user ID is not recognized.  By default, login
         is allowed for all users.  If the pattern takes the form
         USER@HOST then USER and HOST are separately checked, restricting
         logins to particular users from particular hosts.  HOST criteria
         may additionally contain addresses to match in CIDR
         address/masklen format.  The allow/deny directives are processed
         in the following order: DenyUsers, AllowUsers, DenyGroups, and
         finally AllowGroups.

         See PATTERNS in ssh_config(5) for more information on patterns.

Note the second sentence: "If specified, login is allowed only for usernames that match one of the patterns"

When you added seconduser (and only seconduser) to AllowedUsers you locked out all other users. Including root. And whatever you misconfigured in ssh or mistyped when changing seconduser's password prevents you from logging in as that user.

It's not actually possible to get more information as to why you couldn't log in; after all, ssh can't tell if you're a hostile actor trying to brute force the password or a legitimate user that forgot their actual password, and giving the former helpful hints as to how to log in successfully would be something of a security risk.

If you're using standard unix openSSH, you can try using ssh -vvv to connect and see if there's anything in the handshake that suggests what you might be doing wrong other than not entering the right credentials, but given that root did work until you slammed the door on yourself that part probably isn't the problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.