I've been poking around /etc/ssh/sshd_config for the last week or so, trying to figure out how to block ssh access to all users besides myself.

My goal is for it to be impossible for all users except to me to login via ssh, and for my account to be accessible through 2fa+password or key based auth. I currently have the later half of that working, but I can't figure out how to block all users except myself. I already have the lines I'd expect to work in my sshd_config:

AllowUsers me
DenyUsers *

But when I try and ssh into another user account (for example, fred), it still prompts me with Password:. I also tried adding the following line at the top of my /etc/pam.d/sshd:

auth      required   pam_succeed_if.so user ingroup ssh

And having only myself in the ssh group.

What am I doing wrong to block all users besides myself from ssh access? I have to use PAM because that's how my 2fa works.

  • You can use /etc/security/access.conf file to have more control who should and who shouldn't have access to your server. – mrc02_kr Aug 23 '17 at 6:05
  • You are prompted for a password but can you actually log in? – Hauke Laging Aug 23 '17 at 6:14
  • @HaukeLaging I can't login, but it concerns me that a prompt is being sent. That also makes it possible to find the usernames of all the users, which I wouldn't like to be possible. – thesecretmaster Aug 23 '17 at 10:48
  • Don't you need requisite rather than required? And the behaviour is a good one - to prevent the information leakage of which users are worth attacking. – Toby Speight Aug 23 '17 at 10:56
  • @mrc02_kr I'd like to only prohibit SSH access, not stop access entirely. – thesecretmaster Aug 23 '17 at 12:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.