Disable SSH for non root users

Question

How do i disable remote access for non-root users over ssh? i would like to do this on demand if possible.

Answer 1

Everyone is doing this the hard way.. he said deny for all non-root users.. so just edit

/etc/ssh/sshd_config

Add the following

AllowGroups wheel root

Then restart ssh

Anyone in the wheel or root group will be allowed to ssh in

Answer 2

Several possibilities:

• /bin/false as login shell for the normal users in /etc/passwd
• Add only root to AllowUsers in /etc/ssh/sshd_config

Answer 3

Can use PAM as well: cp /etc/security/access.conf /etc/security/sshd.conf
echo "+ : root : ALL" >> /etc/security/sshd.conf
echo "- : ALL : ALL" >> /etc/security/sshd.conf

Then modify /etc/pam.d/sshd to add the following line after the other accounts:
account required pam_access.so accessfile=/etc/security/sshd.conf

This will also allow you to restrict by network if you decide to do so in the future.

Answer 4

If you want it to be on-demand, the standard way is to use /etc/nologin (have a look at man 5 nologin).

Creating this file (with an optional message inside) will deny non-admin logins and display the message instead; removing the file will allow logins back.

It can be applied to ssh, local logins, and anything else that uses PAM; just make sure that the PAM configuration for the service requires pam_nologin.so. (It does by default for ssh and console logins on many distributions)