How to create a (username/password or certificate) white/black list for ssh?

For example of blacklist, I can use any username/password combination to access the server, except the ones on the blacklist.

The ssh version can be OpenSSH.

And the server is a Linux.

Creating lots of users on Linux for white list is not a nice way.

Any approach can be used, like modifying SSH software itself, or using Linux/SSH features, or using other modules.


Maybe I did not describe the situation clearly. Basically, I simply want any username/password combination to be able to login, except the black list.

For example, if the black list is "admin/admin; root/123". I can simply use "abc/123456" to login. The server is like a VERY VULNERABLE one with almost no credential needed.

For white list, I can give a number of username/password/certificate combinations for the list, not just the username.

  • 1
    Using a blacklist of "admin/admin;root/123", what is the expected behavior if a user attempts login with "root/456"? Since that specific combination is NOT in the blacklist, should that be acceptable to login as root?
    – PKapp
    May 18, 2018 at 10:45
  • Play with the PAM stack. May 18, 2018 at 11:31

1 Answer 1


For a blacklist, in your sshd_config add the DenyUsers entry followed by a list of users separated by a space. You can also use DenyGroups in a similar fashion.

For example: DenyUsers jimmy bill joe susan


DenyGroups teachers

A whitelist is created by using the AllowUsers and/or AllowGroups entries in the sshd_config file. If either of these entries is used, only those users or groups listed will be permitted to login.

  • Please see the update. Sorry for the confusion.
    – I Wonder
    May 18, 2018 at 4:35
  • for me I had to use the name as appears in the terminal for this method to work e.g. DenyUsers root@the-host Sep 10, 2019 at 21:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .