1. When I set up my Debian 6, I was wondering, which users apart from root whose password I know can log into my system via SSH?

  2. When I install Apache 2 a user called www-data gets created. Does this user have the right to log into my system via SSH? But if there was some default password for www-data everyone could log in, seems unlikely to me.

  3. Where do I have a list which users are allowed to log into my system via SSH? Can't find anything in the ssh config files.

3 Answers 3


Paradeepchhetri isn't exactly correct.

Debian's unmodified sshd_config has the following:

PubkeyAuthentication yes
PermitEmptyPasswords no
UsePAM yes

Thus, login via ssh would only work for users that have a populated password field in /etc/shadow or an ssh key in ~/.ssh/authorized_keys. Note that the default value for PubkeyAuthentication is yes and for PermitEmptyPasswords is no, so even if you remove them the behavior will be the same.

In the question example, www-data by default won't be allowed to log in since Debian's installer neither assigns a password nor creates a key for www-data.

pam_access, AllowUsers and AllowGroups in sshd_config can be used for finer control if that's needed. In Debian it's strongly encouraged to UsePAM.


By default, login is allowed for all users on Debian.

You can change it by allowing certain users that can log into by editing /etc/ssh/sshd_config file.

As mentioned in the man page of sshd_config.


This keyword can be followed by a list of user name patterns, separated by
spaces. If specified, login is allowed only for user names that match one of the patterns. Only user names are valid; a numerical user ID is not
recognized. By default, login is allowed for all users. If the pattern takes the form USER@HOST then USER and HOST are separately checked, restricting logins to particular users from particular hosts. The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroup, and finally AllowGroups.

  • I added "on Debian" in case someone comes along and reads the question title and answer without reading the question itself. The general answer to the question title is, "it depends on the contents of the shipped sshd_config file." Some OSes ship with root login over SSH disallowed, for example. Apr 18, 2012 at 21:49
  • Thanks, but obviously by default only root can login since he's the only one with a password in /etc/shadow. Apr 19, 2012 at 7:42

By default, SSH server isn't even installed. You would have to install the openssh-server package before anybody could SSH in.

After that, any user has to pass two checks:

  • SSH authentication
  • PAM account checks

SSH authentication means that either the user must have a valid password in /etc/shadow or they have a valid SSH public key with the right permissions in the target user's ~/.ssh/authorized_keys.

Valid passwords are described further in the crypt(3) man page, but basically if the user's 2nd field in /etc/shadow is anything starting with $NUMBER$, it's probably valid, and if it's * or !, it's invalid.

PAM account checks basically means that the account is not expired. You can check that using chage -l USERNAME.

So to answer your questions, to my knowledge:

  1. Only root and the account you create during the installation wizard can log in on a new system
  2. No, because www-data has a hashed password of * and there is no ~www-data/.ssh/authorized_keys file
  3. There's no single list, because there are multiple requirements, but to get an idea, you could try running grep -v '^[^:]*:[!*]:' /etc/shadow
  • 1
    Be careful, the empty password is a valid password, but as bahamat pointed out, the default SSH configuration (and default Debian configuration) disallow SSH login for empty password accounts.
    – Totor
    Mar 25, 2013 at 21:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .