5

How can I modify my sshd_config so that it blocks access to all users except the root user?

I've had a look and I tried 

AllowUsers root
DenyUsers *

But that doesn't do anything

Improve this question
2
  • 2
    I'm curios why you want that, normally (and by default in many distributions) it is exactly the other way round for security reasons.
    – Bobby
    Commented Oct 14, 2012 at 18:49
  • I use keyfile instead of passwords but the goal of this isn't to hide the root account its to reduce the complexity of monitoring
    – Akshat
    Commented Oct 14, 2012 at 22:01

3 Answers 3

Reset to default
7

I tried this myself, adding only the AllowUsers root line, which worked without a hitch. Probably an obvious question, but since you didn't mention it explicitly: did you restart the sshd service after making the modification?

Improve this answer
1

If you're using Linux, you can use the pam_succeed_if.so PAM module (if your distro has it). Other OSes may or may not have it so YMMV.

in /etc/pam.d/sshd:

account    sufficient   pam_succeed_if.so login = <username>

You can also allow specific groups, or numerical uids/gids, etc.

See http://linux.die.net/man/8/pam_succeed_if for more information on this PAM Module.

Improve this answer
0

This method doesn't involve sshd_config, but the effect is the same. I lockout all users except root when I need to do maintenance on my Linux hosts. Just remove the file when you're done.

echo "System maintenance in progress" > /run/nologin
Improve this answer
1
  • 1
    Note that this only blocks users from accidentally logging in. If a user really want to login he can still do something like ssh -t username@host /bin/bash
    – Garo
    Commented Apr 2, 2021 at 1:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .