Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do you allow a user to log in using "su - user" but prevent the user from login in using SSH?

I tried to set the shell to /bin/false but the when I try to su it doesn't work.

Are there several ways to only allow logins by su?

Is SSH's AllowUser the way to go? (how would I do this if it's the way to go)

share|improve this question

11 Answers 11

up vote 40 down vote accepted

You can use AllowUsers / AllowGroups if you have only a few users/groups that are allowed to login via ssh or DenyUsers / DenyGroups if you have only a few users/groups that are not allowed to login. Note that this only restricts login via ssh, other ways of login (console, ftp, ...) are still possible. You need to add these options to your */etc/ssh/sshd_config* file for most ssh installations.

If you have set the login shell to /bin/false you can use su -s /bin/bash user (replace /bin/bash with the shell of your choice)

share|improve this answer
    
thanks a lot to all. I didn't expect to get 2+ upvotes on my question :) I like the "su -s ..." construct a lot and the console/ftp is a good point. I was really after something like "su -s". –  NoozNooz42 Jun 9 '10 at 16:27
1  
The su -s trick is gold. I use it all the time for system accounts I need to test permissions for, e.g., apache, nobody, etc. I usually do su - user -s /bin/bash. The optional argument - may be used to provide an environment similar to what the user would expect had the user logged in directly. –  dmourati Dec 31 '13 at 2:22
    
If you need environment variables (e.g. from /etc/profile) to be loaded, passing an extra dash will do it: su - -s /bin/bash user –  Leons Jan 29 at 18:34

If an account has no password (passwd -d username), they can't log in interactively (console, SSH, etc.). If they have a valid shell, su will still work. Note the "interactively," though; if somebody decides to set up an SSH keypair for the account, it will work!

share|improve this answer
    
does the user need to have a valid shell to su? I'm pretty sure you're still in the same original shell after you su to another user... you don't actually LOG IN as the other user... So, just setting the shell to /dev/null might work aswell. –  Brian Postow Jun 9 '10 at 16:24
    
Yep, it still needs a valid shell: [root@localhost ~]# su daemon This account is currently not available. [root@localhost ~]# su - daemon This account is currently not available. (RHEL system, daemon's shell is /sbin/nologin) –  astrostl Jun 9 '10 at 16:41

In sshd_config add a line DenyUser [username]

Note that this will not prevent that user from logging in via the console.

share|improve this answer

If you still want su to work, you can use sudo -u [username] or pass -s \bin\bash to su as a temporary shell. They both do the same in absence of a shell in /etc/passwd.

share|improve this answer
    
weird that your slashes are the wrong direction. –  dmourati Dec 31 '13 at 2:24

In addition to what's been mentioned above (disable and/or not setting the user password), pam_access module (look up man page on pam_access and access.conf) can be used to control login access.

share|improve this answer

Don't specify a password for the user not allowed to log in or delete it.

# passwd -d myuser
share|improve this answer

as others have said;

DenyUser username or DenyGroup groupname in sshd_config would prevent keypair/password login via ssh.

though i usually do something like AllowGroup ssh or something along those lines, and explicitly add people who need ssh access to that group.

then, you can do as other's have said: passwd -d username to blank out the users password, so they cannot log in at the console, or some other way. or better yet passwd -l username to 'lock' the account. it is possible ssh will deny access to a locked account, even with keys, but i'm not positive.

share|improve this answer
    
Actually ssh will allow you to log in using key authentication even when the account password is locked. –  Richard Holloway Jun 9 '10 at 22:34
    
Good to know, thanks for the clarification... –  cpbills Jun 10 '10 at 14:47

As I mentioned in a comment, I think that you can still su into an account with an invalid shell. So if you set the user's shell to /dev/null or whatever the shell of bin is, you should be able to still su into that user... but any attempt to log in in any way will quit you back out...

share|improve this answer

Knowing which mechanism is best depends on the requirements. If you know the requirements, you can choose the appropriate mechanism. All of the above answers are valid for some set of requirements.

Do you only want to restrict SSH access? Do you need access for mail or ssh methods? Is access only from root?

su - user will require a password for user if it is run be a user other than root. However, sudo -i user -i does not require a password for user.

share|improve this answer

Assuming you only want to su user from root's account, and disable all other access:

Use this (run as root):

usermod -e 1 -L user

This disables password login (as many other answers have advised), but it also expires the account. You can't login to an expired account, e.g. with SSH keys. You can still su user, although it will display a notice that the account has expired.

share|improve this answer

edit /etc/shadow by adding ! to the beginning of the password hash.

username:!<hash>:#####:#:#####:#:::

When securing a new install this is the first thing I do after installing sudo, so nobody is able to use the root user to login or ssh into the system, sudo users may still execute as root user.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.