2

I've been poking around /etc/ssh/sshd_config for the last week or so, trying to figure out how to block ssh access to all users besides myself.

My goal is for it to be impossible for all users except to me to login via ssh, and for my account to be accessible through 2fa+password or key based auth. I currently have the later half of that working, but I can't figure out how to block all users except myself. I already have the lines I'd expect to work in my sshd_config:

AllowUsers me
DenyUsers *

But when I try and ssh into another user account (for example, fred), it still prompts me with Password:. I also tried adding the following line at the top of my /etc/pam.d/sshd:

auth      required   pam_succeed_if.so user ingroup ssh

And having only myself in the ssh group.

What am I doing wrong to block all users besides myself from ssh access? I have to use PAM because that's how my 2fa works.

8
  • You can use /etc/security/access.conf file to have more control who should and who shouldn't have access to your server.
    – mrc02_kr
    Commented Aug 23, 2017 at 6:05
  • You are prompted for a password but can you actually log in? Commented Aug 23, 2017 at 6:14
  • @HaukeLaging I can't login, but it concerns me that a prompt is being sent. That also makes it possible to find the usernames of all the users, which I wouldn't like to be possible. Commented Aug 23, 2017 at 10:48
  • Don't you need requisite rather than required? And the behaviour is a good one - to prevent the information leakage of which users are worth attacking. Commented Aug 23, 2017 at 10:56
  • @mrc02_kr I'd like to only prohibit SSH access, not stop access entirely. Commented Aug 23, 2017 at 12:06

1 Answer 1

3

Using access.conf to prevent ssh, and only ssh, logins does not work. However, it can be accomplished by using pam_access with another config file.

Firstly, PAM must be configured to use pam_access. It might not be by default. There should be a line with account required pam_access.so in the sshd PAM config, likely via the password-auth configuration file, which the sshd config will likely include.

On Fedora, authselect can be used to enable a PAM configuration to use pam_access:

sudo authselect enable-feature with-pamaccess

At this point one might think access could be prevented with a line in access.conf such as:

-:username:sshd

This does not work to prevent username from access when using the service sshd. The reason is this bit from the pam_access manpage:

... or PAM service names in case of non-networked logins.

Since ssh is a network login (PAM's RHOST field is defined), the service name is not used. Only the remote host name, IP address, network group, etc. are used.

This manpage is not entirely accurate, as the PAM service name is only used if the login is non-networked and non-tty. Local logins, e.g. at the console login prompt, desktop greeter, or running sudo, will use the associated tty or X display rather than the service name.

Effectively, the service name is only used for background logins, like with atd or crond. So you can't block just ssh this way as there is no way in access.conf to filter ssh vs anything else.

TL;DR

One can restrict all remote logins, not just with ssh but with all other services too, via:

+:username:LOCAL
-:username:ALL

To only apply to ssh, PAM must be configured to use a different access.conf file for sshd. Add a line like this to /etc/pam.d/sshd, probably just before the line that contains account include password-auth:

account    required     pam_access.so accessfile=/etc/security/access-sshd.conf

Now create /etc/security/access-sshd.conf with access controls that will only apply to ssh logins. Examples:

# Don't allow user 'username' access
-:username:ALL

# Only allow user 'trusted' access and no one else
-:ALL EXCEPT trusted:ALL

# Only allow user 'username' when they are coming from localhost
+:username:127.0.0.1 ::1
-:username:ALL

Note that using localhost instead of the numeric IPv4 and IPv6 address should work, but didn't for me.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .