Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do i disable remote access for non-root users over ssh? i would like to do this on demand if possible.

share|improve this question

4 Answers 4

up vote 8 down vote accepted

Everyone is doing this the hard way.. he said deny for all non-root users.. so just edit

/etc/ssh/sshd_config

Add the following

AllowGroups wheel root

Then restart ssh

Anyone in the wheel or root group will be allowed to ssh in

share|improve this answer
    
he said 'on demand' –  b0fh Aug 9 '10 at 12:58

Several possibilities:

  • /bin/false as login shell for the normal users in /etc/passwd
  • Add only root to AllowUsers in /etc/ssh/sshd_config
share|improve this answer
2  
/bin/false in /etc/passwd would also disable local access. –  mkudlacek Aug 9 '10 at 11:44

Can use PAM as well: cp /etc/security/access.conf /etc/security/sshd.conf
echo "+ : root : ALL" >> /etc/security/sshd.conf
echo "- : ALL : ALL" >> /etc/security/sshd.conf

Then modify /etc/pam.d/sshd to add the following line after the other accounts:
account required pam_access.so accessfile=/etc/security/sshd.conf

This will also allow you to restrict by network if you decide to do so in the future.

share|improve this answer

If you want it to be on-demand, the standard way is to use /etc/nologin (have a look at man 5 nologin).

Creating this file (with an optional message inside) will deny non-admin logins and display the message instead; removing the file will allow logins back.

It can be applied to ssh, local logins, and anything else that uses PAM; just make sure that the PAM configuration for the service requires pam_nologin.so. (It does by default for ssh and console logins on many distributions)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.