6

My Linux has many not-human users like cron, ntp, daemon, http, etc. I want to disable anybody to login as any of this users. Real people on my machine are root and me, so only root and me should be able to login.

For not-human users in the /etc/passwd file /bin/false defined as shell, but I have read it doesn't protect for login via SSH, for example.

passwd -l doesn't protect for login via SSH too (as the man says).

Is there solution at all?

  • 1
    /bin/false should protect, if you use "use-login" in sshd_config. – Nils Oct 27 '12 at 20:00
4

System accounts should already be locked, by setting their password hash to an invalid one (I see x and ! in my /etc/shadow). The only ways to get into their accounts without a password (as far as I know) are ssh with keypair auth (impossible unless someone with write permissions in their home directory put a public key in their ~/.ssh/authorized_keys), you can use Alex's AllowUsers configuration to prevent that remote possibility; and using su as root to get a shell as them. This possibility is impossible to prevent if anyone has access to root power. But if they do have root permissions, suing to a daemon account is the last thing you need to worry about.

  • usermod -p '*' root or usermod -p '!!' root, either would work – Alec Istomin Jul 14 at 23:31
3

Edit /etc/ssh/sshd_config as root. Locate the AllowUsers option and change it to just your username.

Do not allow root to login over SSH.

  • I'm some confused why this is SSH setting. Is there system way to force disable login (by any method: getty, ssh, telnet...) for an user? – user14284 Oct 27 '12 at 20:05
  • 1
    Why should root login be disabled over SSH? – heinrich5991 Oct 28 '12 at 0:33
  • 1
    It is recommended to login as a non-privileged user and use sudo, if root account is shared between several people. This way accountability is preserved - who did what. – Vitaly Osipov Oct 28 '12 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy