20 C
Jaipur
Thursday, January 21, 2021

Allow Or Deny SSH Access To A Particular User Or Group In Linux

Must read

This brief guide will walk you though the steps to allow or deny SSH access to a particular user or a group in Linux. A while ago, we discussed how to limit a user’s access to Linux system using Restricted shell. Once we have put the users in restricted mode, they can’t do anything except what they are allowed to do. It will be helpful when you want to allow a particular user to execute only a specific set of commands. Here in this article, we are going to enable or disable SSH access for an user or group by making a few changes in SSH default configuration file.

Allow Or Deny SSH Access To A Particular User Or Group In Linux

The openSSH default configuration file has two directives for allowing and denying SSH access to a particular user(s) or a group. First, let us see how to allow or enable SSH access to an user and group. Please note that all commands given below should be run as root or sudo user.

1. Allow SSH Access to a user or group

To allow SSH access for a particular user, for example sk, edit sshd_config file:

$ sudo vi /etc/ssh/sshd_config

Press “i” to enter into insert mode and add or modify the following line:

AllowUsers sk

Edit ssh configuration file to allow ssh access to particular user

Replace “sk” with your username. Please mind the space indentation between “AllowUsers” and “sk”. You should use Tab instead of Space-bar. Meaning – add the word “AllowUsers” and hit the Tab key and then specify the username.

You can also specify more than one user as shown below.

AllowUsers user1 user2

To allow an entire group, say for example root, add/edit the following line:

AllowGroups root

This setting will allow all the members of the “root” group to ssh to the Linux server.

Press ESC key to exit insert mode and type :wq to save and quit the SSH config file. Restart SSH service to take effect the changes.

$ sudo systemctl restart sshd

Now, the user sk and all the members of the “root” group are allowed to ssh into your Linux server. The other users (except sk and members of “root” group) are not allowed to access the system via ssh.

To verify it, try to ssh into the Linux server as any one of the non-allowed user:

$ ssh [email protected]

You will get the following error message:

[email protected]'s password: 
Permission denied, please try again.
SSH access permission denied

SSH access permission denied

2. Deny SSH Access to a user or group

To disable or deny SSH access to an user or group, you need to add/modify the following directives in your remote server’s sshd_config file.

  1. DenyUsers
  2. DenyGroups

To deny SSH access to specific user called “sk”, edit sshd_config file:

$ sudo vi /etc/ssh/sshd_config

Add/edit the following line in sshd_config file.

DenyUsers sk

Make sure the space indention is correct. Don’t use Space-bar. Press Tab key and add the username.

Similarly, to deny SSH access to multiple users, specify the usernames with space separated as shown below.

DenyUsers user1 user2

Likewise, to deny SSH access to an entire group, for example root, add:

DenyGroups root

Save and quit the ssh config file. Restart ssh service to take effect the changes.

$ sudo systemctl restart sshd

Now try to ssh to your Linux machine from blocked user account, for example sk:

$ ssh [email protected]

You will get the following message:

[email protected]'s password: 
Permission denied, please try again.
[email protected]'s password:

3. Disable SSH Root Login

Root ssh access is considered a bad practice in terms of security. So it is strongly recommended to disable SSH Root user login to secure your system.

To disable root ssh login, edit sshd_config file:

$ sudo vi /etc/ssh/sshd_config

Find the following line, Uncomment it, and set the value to no.

PermitRootLogin no

Restart SSH service to take effect the changes immediately:

$ sudo systemctl restart sshd

You know now how to grant and restrict SSH access to certain user(s) or a group in Linux. You also learned how to deny or disable SSH root login in Linux. It is one of recommended security practice every Linux admin should implement when setting up a Linux server.

Related read:

Source link

- Advertisement -

More articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest article