When I set up my Debian 6, I was wondering, which users apart from root whose password I know can log into my system via SSH?
When I install Apache 2 a user called www-data gets created. Does this user have the right to log into my system via SSH? But if there was some default password for www-data everyone could log in, seems unlikely to me.
Where do I have a list which users are allowed to log into my system via SSH? Can't find anything in the ssh config files.
Paradeepchhetri isn't exactly correct.
sshd_config has the following:
PubkeyAuthentication yes PermitEmptyPasswords no UsePAM yes
Thus, login via ssh would only work for users that have a populated password field in
/etc/shadow or an ssh key in
~/.ssh/authorized_keys. Note that the default value for
yes and for
no, so even if you remove them the behavior will be the same.
In the question example,
www-data by default won't be allowed to log in since Debian's installer neither assigns a password nor creates a key for
sshd_config can be used for finer control if that's needed. In Debian it's strongly encouraged to
By default, login is allowed for all users on Debian.
You can change it by allowing certain users that can log into by editing
As mentioned in the man page of sshd_config.
This keyword can be followed by a list of user name patterns, separated by
spaces. If specified, login is allowed only for user names that match one of the patterns. Only user names are valid; a numerical user ID is not
recognized. By default, login is allowed for all users. If the pattern takes the form
HOSTare separately checked, restricting logins to particular users from particular hosts. The allow/deny directives are processed in the following order:
DenyGroup, and finally
SSH server isn't even installed. You would have to install the
openssh-server package before anybody could SSH in.
After that, any user has to pass two checks:
- SSH authentication
- PAM account checks
SSH authentication means that either the user must have a valid password in
/etc/shadow or they have a valid SSH public key with the right permissions in the target user's
Valid passwords are described further in the
crypt(3) man page, but basically if the user's 2nd field in
/etc/shadow is anything starting with
$NUMBER$, it's probably valid, and if it's
!, it's invalid.
PAM account checks basically means that the account is not expired. You can check that using
chage -l USERNAME.
So to answer your questions, to my knowledge:
- Only root and the account you create during the installation wizard can log in on a new system
- No, because
www-datahas a hashed password of
*and there is no
- There's no single list, because there are multiple requirements, but to get an idea, you could try running
grep -v '^[^:]*:[!*]:' /etc/shadow